Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Limit the source namespace for a Secret or ConfigMap

See original GitHub issue

Would it be possible to limit the source Secret or ConfigMap used by the reflector to a namespace? For example, only want the reflector to copy a source Secret to other namespaces ONLY if it comes from a specific namespace.

This would be for security reasons as you wouldn’t want any user with access to a namespace to apply the correct annotations and copy those secrets to other namespaces (spamming other namespaces).

I’m assuming this would have to be enabled in the controller via the values file.

I thought the below would do the trick but it only limits the copying to those namespaces (and not from those namespaces) and it’s applied to Secret directly (and not via Controller): reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "<list>"

Issue Analytics

State:
Created 2 years ago
Reactions:1
Comments:11 (3 by maintainers)

Top GitHub Comments

4reactions

winromuluscommented, Oct 27, 2021

Keeping this in mind. Will try to come up with something for filtering.

2reactions

ryaneorthcommented, Jun 6, 2022

Any update or thoughts on this @winromulus? Unfortunately, this missing security control is blocking us from using reflector.

Top Results From Across the Web

Secrets

Secrets are similar to ConfigMaps but are specifically intended to hold confidential data. Caution: Kubernetes Secrets are, by default, stored unencrypted in ...

Using Kubernetes ConfigMaps securely

This article explores how ConfigMaps works, how to use ConfigMaps safely, ... Pods in the same Kubernetes namespace accessing them remotely.

Kubernetes Secrets and ConfigMaps | by Asad Faizi

Developers need to look for other solutions such as volumes or external data sources if configuration data exceeds that limit.

Sharing secret across namespaces - kubernetes

The accepted answer is correct: Secrets can only be referenced by pods in that same namespace. So here is a hint if you...

Synchronize Configuration across Namespaces

But you can restrict the source namespace for configmaps and secrets by passing config.configSourceNamespace value during installation. $ helm install kubed ...