Sharing objects across namespaces in a container-orchestration system
A method for replicating a set of parent resources from an administrator namespace to a set of tenant namespaces is described. The method includes receiving, by the administrator namespace, a global object that includes a set of object fields that reference (1) a set of parent resources and (2) the set of tenant namespaces; monitoring, by an operator controller of the administrator namespace, the global object to determine whether a change has been made to the global object; and replicating, by the operator controller, the set of parent resources to the set of tenant namespaces as child resources based on the global object in response to detecting a change to the global object.
1. A method for replicating a set of parent resources from an administrator namespace to a set of namespaces for customers, the method comprising:
receiving, by the administrator namespace, a global object that includes a set of object fields that reference (1) a set of parent resources and (2) the set of namespaces for customers;
monitoring, by an operator controller of the administrator namespace, the global object to determine whether a change has been made to the global object; and
replicating, by the operator controller, the set of parent resources to the set of namespaces for customers as child resources based on the global object in response to detecting a change to the global object.
2. The method of claim 1 , further comprising:
receiving, by the administrator namespace, a custom resource definition that describes a schema for the global object,
wherein the operator controller verifies that the global object complies with the schema of the custom resource definition before monitoring the global object.
3. The method of claim 2 , wherein the schema of the custom resource definition indicates a set of fields that are permitted to be in the global object and a set of fields that are required to be in the global object, and
wherein the set of object fields are to include the set of fields that are required to be in the global object and the set of object fields are to be selected from the set of fields that are permitted to be in the global object.
4. The method of claim 1 , further comprising:
monitoring, by the operator controller, the child resources in the set of namespaces for customers to detect changes between each of the child resources and each respective parent resource in the set of parent resources; and
in response to detecting a change to a child resource in a namespace for a customer, replicating, by the operator controller, a respective parent resource to the namespace for the customer to replace the child resource for which the change was detected.
5. The method of claim 1 , wherein the change to the global object includes one or more of (1) additions of object fields to the global object, (2) changes to values for the set of object fields within the global object, (3) deletion of object fields within the global object, and (4) creation or receipt of the global object.
6. The method of claim 1 , wherein each of the namespaces for customers in the set of namespaces for customers does not have permission to access resources from the administrator namespace or other namespaces for customers in the set of namespaces for customers; and
wherein the administrator namespace has permission to access resources in each of the namespaces for customers in the set of namespaces for customers.
7. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, will cause said processor to perform operations comprising:
receiving a global object that includes a set of object fields that reference (1) a set of parent resources and (2) a set of namespaces for customers;
monitoring the global object to determine whether a change has been made to the global object; and
replicating the set of parent resources from an administrator namespace to the set of namespaces for customers as child resources based on the global object in response to detecting a change to the global object.
8. The non-transitory machine-readable storage medium of claim 7 , wherein the operations further include:
receiving a custom resource definition that describes a schema for the global object; and
verifying that the global object complies with the schema of the custom resource definition before monitoring the global object.
9. The non-transitory machine-readable storage medium of claim 8 , wherein the schema of the custom resource definition indicates a set of fields that are permitted to be in the global object and a set of fields that are required to be in the global object, and
wherein the set of object fields are to include the set of fields that are required to be in the global object and the set of object fields are to be selected from the set of fields that are permitted to be in the global object.
10. The non-transitory machine-readable storage medium of claim 7 , wherein the operations further include:
monitoring the child resources in the set of namespaces for customers to detect changes between each of the child resources and each respective parent resource in the set of parent resources; and
in response to detecting a change to a child resource in a namespace for a customer, replicating a respective parent resource to the namespace for the customer to replace the child resource for which the change was detected.
11. The non-transitory machine-readable storage medium of claim 8 , wherein the change to the global object includes one or more of (1) additions of object fields to the global object, (2) changes to values for the set of object fields within the global object, (3) deletion of object fields within the global object, and (4) creation or receipt of the global object.
12. The non-transitory machine-readable storage medium of claim 8 , wherein each of the namespaces for customers in the set of namespaces for customers does not have permission to access resources from the administrator namespace or other namespaces for customers in the set of namespaces for customers; and
wherein the administrator namespace has permission to access resources in each of the namespaces for customers in the set of namespaces for customers.
13. A device for replicating a set of parent resources from an administrator namespace to a set of namespaces for customers, the device comprising:
a processor; and
a set of memory units, wherein the set of memory units include instructions that, when performed by the processor, cause the processor to:
receive a global object that includes a set of object fields that reference (1) a set of parent resources and (2) the set of namespaces for customers;
monitor the global object to determine whether a change has been made to the global object; and
replicate the set of parent resources to the set of namespaces for customers as child resources based on the global object in response to detecting a change to the global object.
14. The device of claim 13 , wherein the instructions further cause the processor to:
receive a custom resource definition that describes a schema for the global object, and
verify that the global object complies with the schema of the custom resource definition before monitoring the global object.
15. The device of claim 14 , wherein the schema of the custom resource definition indicates a set of fields that are permitted to be in the global object and a set of fields that are required to be in the global object, and
wherein the set of object fields are to include the set of fields that are required to be in the global object and the set of object fields are to be selected from the set of fields that are permitted to be in the global object.
16. The device of claim 13 , wherein the instructions further cause the processor to:
monitor the child resources in the set of namespaces for customers to detect changes between each of the child resources and each respective parent resource in the set of parent resources; and
in response to detecting a change to a child resource in a namespace for a customer, replicate a respective parent resource to the namespace for the customer to replace the child resource for which the change was detected.
17. The device of claim 13 , wherein the change to the global object includes one or more of (1) additions of object fields to the global object, (2) changes to values for the set of object fields within the global object, (3) deletion of object fields within the global object, and (4) creation or receipt of the global object.
18. The device of claim 13 , wherein each of the namespaces for customers in the set of namespaces for customers does not have permission to access resources from the administrator namespace or other namespaces for customers in the set of namespaces for customers; and
wherein the administrator namespace has permission to access resources in each of the namespaces for customers in the set of namespaces for customers.