add option to replicate only to defined namespaces
monotek opened this issue · 9 comments
currently only exclude is possible which means you need to know all namespaces you want to have excluded.
a new env var NAMESPACE_INCLUDE should be available.
default should be "all".
+1. Was going to ask the same thing.
I've been running clusters where I have a user namespace <project> and a supporting namespace we manage for the user <project>-admin. I'd like to sync secrets managed in the <project>-admin namespace (cert-manager generated/managed) into the <project> namespace. So I'd need a way to specify just the namespace I want it to go into.
wolud it also be an option to add an annotation to a single secret with the list of namespaces? I'm currently thinking how to solve it and also be flexible.
That could be another option, but does run into problems with cert-manager specifically:
cert-manager/cert-manager#2576
ok I will think about it. Thank's for your answer.
@kfox1111
you maybe could use kubed (https://github.com/appscode/kubed) as a workaround
@monotek, no it won't work. See referenced issue above.
TL;DR
I want to place a Cert-Manager Certificate request in a namespace called -admin where we manage stuff on behalf of users. In there is an ingress-nginx running in there that watches namespace . In single namespace mode, ingress-nginx only watches for tls certificates in that namespace and cert-manager will only create certificate secrets in the same namespace as the certificate object. What this means, is I need a way of syncing a secret from one namespace to another. In addition, cert-manager doesn't support annotating/labeling secrets it creates. So Kubed wont work as it must have labels.
Secret-replicator will just about work, but only needs to sync from -admin to , not to every other namespace.
Looks like this may be implemented already?
cacb280
Is there a plan to cut a new release soon with this in place?
Thanks!
Kevin
Actually, I hit another snag. This only looks to be able to run across all namespaces. I'd be wanting to use it to watch one namespace and syncronize into a second namespace and have multiple instances of secret-replicator running in parallel looking at nonoverlapping namespaces.