You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It might be useful when we have the folowing case:
We run terraform in flux-system namespace where we have an appropriate ServiceAccount with permissions in cloud to create resources
We generate outputs and save them to secret using writeOutputsToSecret
We want to consume those outputs in services namepace with HelmRelease's valuesFrom
In above case we don't want to create Terraform and ServiceAccount with cloud permissions for each service namespace but it is not possible to create cross-namespaced secret with Terraform custom resource
The text was updated successfully, but these errors were encountered:
With security-first, we have a strong multi-tenancy design which must not violate the namespace boundary.
For example in this design, a runner is solely responsible to writing outputs. A runner is namespace scoped Pod, and it must not be allowed to access anything beyond its scope.
Relaxing this enforcement will cause many security problems. So we cannot implement this relaxation.
It might be useful when we have the folowing case:
flux-system
namespace where we have an appropriateServiceAccount
with permissions in cloud to create resourceswriteOutputsToSecret
HelmRelease
'svaluesFrom
In above case we don't want to create
Terraform
andServiceAccount
with cloud permissions for each service namespace but it is not possible to create cross-namespaced secret withTerraform
custom resourceThe text was updated successfully, but these errors were encountered: