backlogenhancementgood first issue
Métriques du dépôt
- Stars
- (9 222 étoiles)
- Métriques de merge PR
- (Métriques PR en attente)
Description
Currently there're are 3 scopes how a Sealed Secret can be encrypted:
- strict
- namespace
- cluster-wide
We're maintaining a multi-tenant cluster and users are asking how they can reuse an existing Sealed Secret for a different namespace without encrypting again or make them cluster-wide.
A possible approach would be to support encryption of Sealed Secrets using a namespace selector as each tenant has its own set of labels on their namespaces.
Something like:
kubeseal --scope namespace-selector --selector owner=team1 -oyaml < secret.yaml > sealedsecret.yaml
The Sealed Secrets controller would only decrypt the Sealed Secret if the corresponding namespace has the label owner set to team1.
What are your thoughts about adding namespace selector as scope? Is this a feature which we might add?