Do not add default namespace if there is none in source file? about sealed-secrets HOT 6 CLOSED

Ok, so it seems that namespace is somehow used in the encryption? And I cannot reuse same encrypted file in multiple namespaces?

from sealed-secrets.

@gytisgreitai see #61 - PR forthcoming to support this in kubeseal

from sealed-secrets.

@gytisgreitai this is a feature :)

Imagine you had two users using the same cluster, but who should not be able to read each other's secrets. Without this feature, the SealedSecret from Alice could be uploaded to the cluster by Bob (in Bob's namespace), and the controller would happily decrypt Alice's SealedSecret for Bob.
To prevent this attack, the SealedSecret is created in a way that is cryptographically tied to the namespace+name of the original input Secret. The controller will refuse to decrypt a SealedSecret that has been "moved" to a different namespace+name.

#61 is a way to disable this feature, effectively making the SealedSecret "cluster wide". With #61, You can add the "sealedsecrets.bitnami.com/cluster-wide": "true" annotation to the input Secret, and kubeseal and the controller will disable/ignore the namespace+name check.

@gytisgreitai Does that make more sense? I attempted to explain the above in the README (https://github.com/bitnami/sealed-secrets/blame/master/README.md#L183), but it could certainly be clearer / more prominent. Patches to the docs gratefully accepted.

from sealed-secrets.

Uh I'm so sorry, I searched for issues, but should have thoroughly read the README.md

Yes, that makes perfect sense, though we're a small shop so does not apply to us :) I'll wait for #61 to be merged and release.

Thank you for great work, kubeseal looks awesome :)

from sealed-secrets.

@gytisgreitai this is a feature :)

Imagine you had two users using the same cluster, but who should not be able to read each other's secrets. Without this feature, the SealedSecret from Alice could be uploaded to the cluster by Bob (in Bob's namespace), and the controller would happily decrypt Alice's SealedSecret for Bob.
To prevent this attack, the SealedSecret is created in a way that is cryptographically tied to the namespace+name of the original input Secret. The controller will refuse to decrypt a SealedSecret that has been "moved" to a different namespace+name.

#61 is a way to disable this feature, effectively making the SealedSecret "cluster wide". With #61, You can add the "sealedsecrets.bitnami.com/cluster-wide": "true" annotation to the input Secret, and kubeseal and the controller will disable/ignore the namespace+name check.

@gytisgreitai Does that make more sense? I attempted to explain the above in the README (https://github.com/bitnami/sealed-secrets/blame/master/README.md#L183), but it could certainly be clearer / more prominent. Patches to the docs gratefully accepted.

@anguslees . Could you provide me the sample how to add the annotation?. i am doing this for the adm namespace

 kubectl -n adm create secret docker-registry docker-registry-secret --docker-server=xxxxx --docker-username=xxxx --docker-password=xxxx --docker-email="xxxx" --dry-run -o json > docker-registry-secret-clusterwide.json

Edited the docker-registry-secret-clusterwide.json and added the following

    "metadata": {
        "name": "docker-reg-secret-clusterwide",
        "namespace": "adm",
        "creationTimestamp": null,
        "sealedsecrets.bitnami.com/cluster-wide": "true"
    },

Then ran the following

./kubeseal --format=yaml --cert=pub-cert.pem < docker-reg-secret-clusterwide.json \
> docker-reg-secret-clusterwide.yaml

However i have to re add the "sealedsecrets.bitnami.com/cluster-wide": "true" in the yaml file. Is that correct? I would like to use this secret in other namespaces.

from sealed-secrets.

@linuxbsdfreak: annotations are nested one level further, like:

"metadata": {
   "name": "docker-reg-secret-clusterwide",
   "namespace": "adm",
   "creationTimestamp": null,
   "annotations": {
      "sealedsecrets.bitnami.com/cluster-wide": "true"
   }
},
...

If it's all working correctly, kubeseal will automatically add the same annotation to the produced SealedSecret (and encrypt slightly differently).

from sealed-secrets.