run sealed-secrets controller for multiple namespaces

[aliartiza75]

Hello everyone,

Q1 Is there a way to run this controller for multiple namespaces with these conditions:

• I don't wanna run multiple instances of Sealed Secret controller for each namespace.
• I don't wanna run the controller with ClusterRole (because in this way it can access all the namespaces).

Q2 How can I run this controller for a custom namespace (by dynamically specifying its name using env var) because after looking at the controller.yaml file, I found out that there is no env var is being passed to it except namespace specification in metatdata field?

Need help in this regards

Thank you.

[anguslees]

Q1 Is there a way to run this controller for multiple namespaces with these conditions:

iow: You want to run sealed-secrets on a list of explicit namespaces?

This can't be done using the existing code, but of course you could modify it to do so. You would need to watch each of the chosen namespaces separately (in separate goroutines), and then feed events into the existing workqueue.

Q2 How can I run this controller for a custom namespace?

The controller will run in any namespace you start it in. You can modify the controller.yaml file to specify any metadata.namespace you care to use. You will also need to change the namespace in the RBAC rules.

An alternative is just to modify this line in the jsonnet, and then regenerate the YAML files (see the Makefile).

Just to be clear, the controller will still watch for SealedSecrets in all namespaces, regardless of which namespace it runs from.

[aliartiza75]

An alternative is just to modify this line in the jsonnet, and then regenerate the YAML files (see the Makefile).

Can't we do this using helm charts instead of modifying the code files?

[mkmik]

Can't we do this using helm charts instead of modifying the code files?

Yes. And you can also use kustomize (built-in feature in kubectl: kubectl apply -k)

[mkmik]

closing this issue since it seems to me the questions have been answered.

The main readme now mentions how to run sealed secrets in another namespace.
The upcoming v0.9.0 release will default to running it in a dedicated namespace (although still requiring ClusterRole).

We're also considering low-privilege self-service deployment for multi-tenant environments, will be tracked in #233.

[ThomasVitt]

Same here! My customer has a large multi-tenant Redhat Openshift Cluster, and I won't get ClusterAdmin rights, just for a dozen namespaces. The sealedsecrets controller won't stop complaining about not having cluster-wide view of sealedsecrets.

[mkmik]

The controller has a flag:

namespaceAll   = flag.Bool("all-namespaces", true, "Scan all namespaces or only the current namespace (default=true).")

Set this to false (e.g. via the env var "SEALED_SECRETS_ALL_NAMESPACES=false") in the controller yaml manifest.

(If you cannot install extra RBAC rules we ship controller-norbac.yaml that is like controller.yaml but without the RBAC resources)

I thought we documented this but I see the readme doesn't mention it yet and the helm chart (which used to be community maintained until recently when it was merged here) too doesn't seem to support it.

See #324

[mkmik]

@ThomasVitt we'll track the issue about missing documentation in #501, let's move the conversation there

[ThomasVitt]

@mkmik I want to bring up the discussion again :-)
My customer has about 400 dev teams, and each dev team uses 3-6 own namespaces for their applications. All apps are running on one large Openshift Cluster. We will not get cluster-wide permissions on the cluster to deploy the sealedsecrets controller.
But I don't want to run a controller in every namespace, but at the moment that's the only option.

I would like to modify the code so that you can provide a list of namespaces which one controller can watch and unseal secrets into. This would be my first time contributing to a github project, can you tell me how we should proceed? Should I just provide the pull-request and discuss it with you guys?

Thanks, Thomas

[ThomasVitt]

Mybe we'd move the conversation to Issue #233 !?

[mkmik]

Yes or open another issue with the smaller scope (iirc #233 also covers the problem if installing CR definitions)