Feature: Global configmaps and secrets

[blakebarnett]

This might be a little bit crazier than the last one, but I keep getting asked why it's not possible to have a global/default configmap or secret. It seems that with RBAC enabled, and control over what gets written to the default namespace this is reasonable.

It would be awesome if something like konfd would enable this with an annotation on a resource in the default namespace, something like:

konfd.io/is-global: "true"

I can see the case being made that it should only behave as a default (given the namespace name) and should not overwrite existing resources in other namespaces if they already exist.

[ofpiyush]

I wrote this to solve similar problems with our clusters https://github.com/verloop/nsync

[kelseyhightower]

This is pretty interesting, but I think it will make things super hard to reason about. How to handle errors when data is not available in all namespaces to resolve the template?