Sharing objects across namespaces in a container-orchestration system

A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, will cause said processor to perform operations comprising:

• receiving a custom resource definition that describes a schema for the global object;
• receiving a global object that includes a set of object fields that reference (1) a set of parent resources and (2) a set of tenant namespaces;
• verifying that the global object complies with the schema of the custom resource definition;
• monitoring the global object to determine whether a change has been made to the global object;
• and
• replicating the set of parent resources from an administrator namespace to the set of tenant namespaces as child resources based on the global object in response to detecting a change to the global object, wherein each of the child resources is one of (1) a secret, for use by tenant services of the set of tenant namespaces for authentication in relation to a shared service and (2) a configuration map for configuring the tenant services of the set of tenant namespaces.

A device for replicating a set of parent resources from an administrator namespace to a set of tenant namespaces, the device comprising:

• a processor;
• and
• a set of memory units, wherein the set of memory units include instructions that, when performed by the processor, cause the processor to:
• receive a custom resource definition that describes a schema for the global object;
• receive a global object that includes a set of object fields that reference (1) a set of parent resources and (2) the set of tenant namespaces;
• verify that the global object complies with the schema of the custom resource definition;
• monitor the global object to determine whether a change has been made to the global object;
• and
• replicate the set of parent resources to the set of tenant namespaces as child resources based on the global object in response to detecting a change to the global object, wherein each of the child resources is one of (1) a secret, for use by tenant services of the set of tenant namespaces for authentication in relation to a shared service and (2) a configuration map for configuring the tenant services of the set of tenant namespaces.