Allow secrets with user credentials in prepared databases be part of different namespaces

[juanmbellini]

Hi! This is sort of a feature request.

I'm trying the operator in Minikube (in an Intel Macbook Pro, using Hyperkit as hypervisor). The operator's version is 1.7.1

The feature I would like to have is the following: Using PreparedDatabases, you can create a set of users with different privileges (owner, write and read). In my setup I have my services running in namespace A, and databases clusters running in namespace A--databases. What it would be great is the owner user credentials' secrets be part of the A--databases namespace, and the other users be part of the A namespace.

This would allow that no application has no other privilege over the database as it cannot reach the secret from it. The owner user would be used to create tables and other objects, and the read/write users would be used by the services.

What do you think about?

[FxKu]

Hm, so far you can only choose a different secretNamespace for secrets of all roles. Not sure, if we should introduce

1. another flag for PreparedDatabases to exclude secrets of owner roles and let them live in the DB namespace - or
2. make it the default behavior, putting the owner secret always in the DB namespace.
3. I can also think of users requiring the owner role for schema migrations, wanting the secret in yet another separate namespace (like a secretNamespaceOwners option)...

Open for discussions...