A Kubernetes operator for replicating Secrets and ConfigMaps across namespaces

Installation

This guide covers different ways to install Replizieren in your Kubernetes cluster.

Prerequisites

The easiest way to install is using the install manifest from a specific release:

# Install a specific version (recommended for production)
kubectl apply -f https://github.com/Kammerdiener-Technologies/replizieren/releases/download/v0.0.1/install.yaml

Or install the latest development version from main:

# Install latest (for development/testing)
kubectl apply -f https://raw.githubusercontent.com/Kammerdiener-Technologies/replizieren/main/dist/install.yaml

This will:

  1. Create the replizieren-system namespace
  2. Deploy the controller with appropriate RBAC permissions
  3. Start watching for Secrets and ConfigMaps with replication annotations

Verify Installation

# Check the controller is running
kubectl get pods -n replizieren-system

# Expected output:
# NAME                                      READY   STATUS    RESTARTS   AGE
# replizieren-controller-manager-xxx        1/1     Running   0          30s

Install with Kustomize

For more control over the installation, use kustomize:

# Using kustomize with a specific version
kubectl apply -k https://github.com/Kammerdiener-Technologies/replizieren/config/default?ref=v0.0.1

Or clone and deploy:

git clone https://github.com/Kammerdiener-Technologies/replizieren.git
cd replizieren
make deploy IMG=ghcr.io/kammerdiener-technologies/replizieren:v0.0.1

Build from Source

If you need to customize the operator or run a development version:

1. Clone the Repository

git clone https://github.com/Kammerdiener-Technologies/replizieren.git
cd replizieren

2. Build the Image

# Single architecture
make docker-build IMG=your-registry/replizieren:latest

# Multi-architecture (amd64 + arm64)
make docker-buildx IMG=your-registry/replizieren:latest

3. Push to Your Registry

make docker-push IMG=your-registry/replizieren:latest

4. Deploy

make deploy IMG=your-registry/replizieren:latest

Configuration Options

Resource Limits

The default deployment uses conservative resource limits:

resources:
  limits:
    cpu: 500m
    memory: 128Mi
  requests:
    cpu: 10m
    memory: 64Mi

To customize, edit config/manager/manager.yaml before deploying, or patch after deployment:

kubectl patch deployment replizieren-controller-manager \
  -n replizieren-system \
  --type='json' \
  -p='[{"op": "replace", "path": "/spec/template/spec/containers/0/resources/limits/memory", "value": "256Mi"}]'

Replicas

For high availability, you can increase replicas. The controller uses leader election, so only one instance is active at a time:

kubectl scale deployment replizieren-controller-manager \
  -n replizieren-system \
  --replicas=3

Namespace Restriction

By default, Replizieren watches all namespaces. To restrict to specific namespaces, you would need to modify the controller code (feature planned for future releases).

RBAC Permissions

Replizieren requires the following permissions:

Resource Verbs Purpose
secrets get, list, watch, create, update, patch, delete Replicate secrets
configmaps get, list, watch, create, update, patch, delete Replicate configmaps
namespaces get, list, watch Discover target namespaces
deployments get, list, patch Trigger rollouts

The full ClusterRole is defined in config/rbac/role.yaml.

Uninstalling

Using Make

make undeploy

Manual Uninstall

# Delete using the same manifest you installed with
kubectl delete -f https://github.com/Kammerdiener-Technologies/replizieren/releases/download/v0.0.1/install.yaml

# Or delete namespace (removes everything)
kubectl delete namespace replizieren-system

Note: Uninstalling Replizieren does NOT delete the replicated Secrets and ConfigMaps. They will remain in their target namespaces.

Troubleshooting

Controller Not Starting

Check the logs:

kubectl logs -n replizieren-system deployment/replizieren-controller-manager

RBAC Errors

If you see permission denied errors, ensure you have cluster-admin privileges when installing:

kubectl auth can-i create clusterrole --all-namespaces

Resources Not Replicating

  1. Verify the annotation is correct: 
    kubectl get secret my-secret -o jsonpath='{.metadata.annotations}'
  2. Check controller logs for errors: 
    kubectl logs -n replizieren-system deployment/replizieren-controller-manager -f
  3. Ensure target namespace exists: 
    kubectl get namespace target-namespace

Next Steps