repository·main·Indexed 23 days ago
https://github.com/emberstack/kubernetes-reflectorA Kubernetes addon that monitors changes to Secret and ConfigMap resources and reflects those changes to mirror resources in the same or other namespaces. It supports automatic mirror creation, manual mirroring via annotations, and integration with cert-manager for mirroring automatically generated secrets.
Secret and ConfigMap resources. When a change is detected in a source resource, Reflector automatically reflects those changes to designated mirror resources in the same namespace or in other namespaces.Reflector can automatically create and manage mirror resources with the same name as the source in target namespaces.
Add these to the source resource:
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: Set to "true" to enable automatic creation. (Note: Requires reflection-allowed to be true).reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: A list of namespaces where mirrors should be automatically created. If omitted, all namespaces are allowed.reflector.v1.k8s.emberstack.com/reflection-auto-namespaces-selector: A Kubernetes label selector to select namespaces for automatic mirrors.You can use Reflector to mirror secrets automatically generated by cert-manager.
Annotate the Certificate resource's spec.secretTemplate.annotations to permit reflection on the resulting secret.
Annotate an Ingress using the cert-manager.io/secret-template annotation. The value must be a JSON string containing the desired annotations.
Note: The cert-manager.io/secret-template approach is used to inject annotations into the secret created by the certificate issuance process.
# Example: Certificate resource
apiVersion: cert-manager.io/v1
kind: Certificate
...
spec:
secretTemplate:
annotations:
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: ""
...
# Example: Ingress resource
apiVersion: networking.k8s.io/v1
kind: Ingress
...
metadata:
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
cert-manager.io/secret-template: |
{"annotations": {"reflector.v1.k8s.emberstack.com/reflection-allowed": "true", "reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces": ""}}
...The recommended way to deploy Reflector is via Helm. You can install it directly from an OCI registry or by adding the Emberstack Helm repository.
Option 1: Install via OCI registry
helm upgrade --install reflector oci://ghcr.io/emberstack/helm-charts/reflectorOption 2: Install via Helm repository
helm repo add emberstack https://emberstack.github.io/helm-charts
helm repo update
helm upgrade --install reflector emberstack/reflector$ helm upgrade --install reflector oci://ghcr.io/emberstack/helm-charts/reflectorTo deploy Reflector without Helm, you can apply the reflector.yaml file directly from the latest release on GitHub. It is common practice to deploy this into the kube-system namespace.
$ kubectl -n kube-system apply -f https://github.com/emberstack/kubernetes-reflector/releases/latest/download/reflector.yamlTo manually create a mirror for a source resource, add the reflects annotation to the mirror object. The value must be in the format <source-namespace>/<source-name>.
reflector.v1.k8s.emberstack.com/reflects: The full name of the source object (e.g., default/my-secret).reflector.v1.k8s.emberstack.com/reflected-version: If you are performing manual changes to a mirror (e.g., via Helm), add this annotation with an empty value ("") to reset the reflected version and allow Reflector to re-sync.data field.data and binaryData fields.apiVersion: v1
kind: Secret
metadata:
name: mirror-secret
annotations:
reflector.v1.k8s.emberstack.com/reflects: "default/source-secret"
data:
...To allow a Secret or ConfigMap to be mirrored to other namespaces, you must add specific annotations to the source resource.
reflector.v1.k8s.emberstack.com/reflection-allowed: Set to "true" to permit reflection.reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: A comma-separated list of namespaces or regular expressions allowed to receive the reflection. If omitted, all namespaces are allowed.reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces-selector: A Kubernetes label selector (e.g., env=production) to permit reflection only to namespaces matching the selector.If both a list and a selector are provided, a namespace matches if it satisfies either condition.
apiVersion: v1
kind: Secret
metadata:
name: source-secret
annotations:
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "namespace-1,namespace-2,namespace-[0-9]*"
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces-selector: "env=production"
data:
...When deploying with Helm, you can customize the behavior of Reflector using the following configuration parameters:
| Parameter | Description | Default |
|---|---|---|
image.repository | Container image repository | emberstack/kubernetes-reflector |
image.tag | Container image tag | Same as chart version |
configuration.logging.minimumLevel | Logging minimum level | Information |
configuration.watcher.timeout | Maximum watcher lifetime in seconds | `` |
configuration.watcher.excludedNamespaces | Comma-separated list of namespace glob patterns to exclude (supports * and ?). Example: "ephie-*,kube-system,*-temp" | `` |
configuration.kubernetes.skipTlsVerify | Skip TLS verify when connecting to the cluster | false |
rbac.enabled | Create and use RBAC resources | true |
serviceAccount.create | Create ServiceAccount | true |
resources | Resource limits | {} |