Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: Add cross-namespace writeOutputsToSecret for Terraform #1267

Open
hirenko-v opened this issue Mar 25, 2024 · 1 comment
Open

Feature: Add cross-namespace writeOutputsToSecret for Terraform #1267

hirenko-v opened this issue Mar 25, 2024 · 1 comment

Comments

@hirenko-v
Copy link

hirenko-v commented Mar 25, 2024

It might be useful when we have the folowing case:

  • We run terraform in flux-system namespace where we have an appropriate ServiceAccount with permissions in cloud to create resources
  • We generate outputs and save them to secret using writeOutputsToSecret
  • We want to consume those outputs in services namepace with HelmRelease's valuesFrom

In above case we don't want to create Terraform and ServiceAccount with cloud permissions for each service namespace but it is not possible to create cross-namespaced secret with Terraform custom resource

@chanwit
Copy link
Collaborator

chanwit commented Mar 26, 2024

With security-first, we have a strong multi-tenancy design which must not violate the namespace boundary.
For example in this design, a runner is solely responsible to writing outputs. A runner is namespace scoped Pod, and it must not be allowed to access anything beyond its scope.

Relaxing this enforcement will cause many security problems. So we cannot implement this relaxation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants