<p>I am planning to create a special 'deployer' deployment on k8s (one 'deployer' per cluster).
It's role would be to pull specifications from a central place, create k8s manifests and apply them. 
The end result should be multiple deployments, each in it's own namespace with service and ingress, as well as a secret containing DB credentials.</p>

<p>I don't want to directly transmit and manage the DB details. Instead, I was thinking of creating a CustomResourceDefinition 'dbservice' that would contain a DB service name among the rest. Then configure a k8s operator that would:</p>

<ol>
<li>Take (monitor) such a 'dbservice' resource.</li>
<li>Check with a DB hosting service if such a service exists already. If not it would create it with some specifications from the custom resource.</li>
<li>Get the hostname, password, user, database name and port, and store them in a secret that would be used by the deployment (envvar).</li>
</ol>

<p>That way:</p>

<ol>
<li>Each deployment would wait for it's DB secret and would not start until the secret exists, which means that the DB is ready.</li>
<li>I wouldn't have to manage DB services manually.</li>
<li>I wouldn't have to transmit passwords via wire.</li>
</ol>

<p>What needs to happen for this to work (according to my plan):</p>

<ol>
<li>The operator would need to have permissions to talk with the DB hosting provider (will probably access another k8s stored secret with the API key).</li>
<li>The operator would need to have permissions to create secrets in all namespaces.</li>
</ol>

<hr>

<p>Since I'm fairly new to k8s and devops in general, I wanted to verify that this approach is sane and not an anti-pattern.</p>

Alechko
<p>It's absolutely sane, and kind of it even implemented already <a href="https://github.com/mumoshu/aws-secret-operator" rel="nofollow noreferrer">https://github.com/mumoshu/aws-secret-operator</a> but it uses AWS secret manager as a backend instead of DB</p>

<p>UPD: Another similar solution bubbled up just today: <a href="https://godaddy.github.io/2019/04/16/kubernetes-external-secrets/" rel="nofollow noreferrer">https://godaddy.github.io/2019/04/16/kubernetes-external-secrets/</a></p>
