// the find
emberstack/kubernetes-reflector
Custom Kubernetes controller that can be used to replicate secrets, configmaps and certificates.
Reflector is a Kubernetes controller that syncs secrets and configmaps across namespaces by watching source resources and copying them to annotated mirrors. It solves the real problem of cert-manager certificates or pull secrets that need to exist in multiple namespaces without manual duplication. Target audience is platform engineers running multi-tenant clusters.
Annotation-only configuration means zero changes to application manifests — the source resource opts in, mirrors opt in, and Reflector handles the rest. Namespace filtering supports both glob patterns and Kubernetes label selectors, which covers the common 'copy to all prod namespaces' case cleanly. Auto-mirror creation with automatic cleanup on source deletion prevents orphaned secrets drifting out of sync. Integration test suite runs against a real Kubernetes cluster (fixtures spin up actual resources), not fakes.
No webhook admission control — reconciliation is purely watch-based, so there's a window between when a mirror is created and when it gets its first sync where the data field could be empty or stale. The annotation namespace (reflector.v1.k8s.emberstack.com/...) is verbose and there are at least 7 distinct annotations to learn; a single structured annotation would be easier to audit. No support for CustomResourceDefinitions or other resource types beyond Secret and ConfigMap, which means you still need a separate solution if you want to mirror anything else. The conflict-skip behavior on auto-mirrors (silently skips namespaces where a same-named resource already exists) can mask configuration mistakes with just a warning log.