rubenllrebelo opened a new issue, #2910: URL: https://github.com/apache/apisix-ingress-controller/issues/2910
### Description In 2.2.0 the controller's manager lists and watches `Secret` objects across the whole cluster. The chart therefore has to grant `get/list/watch` on secrets through a ClusterRole, and there is no setting to limit that cache to one namespace or to a set of namespaces. If we replace the ClusterRole with a namespaced Role that allows secrets only in the controller's own namespace, the controller exits during startup: ``` failed waiting for *v1.Secret Informer to sync ``` Setting a namespace selector for watched resources doesn't help. The Secret informer is still cluster-scoped, so cluster-wide read access stays mandatory. This matters wherever other workloads keep sensitive Secrets in the same cluster. The controller can read every one of them, even though it only needs the TLS and credential Secrets referenced by the resources it manages. #2138 asked for the same thing on 1.x and was closed as stale. ### Proposal - Add an option (flag, config field and chart value) that limits the controller-runtime cache for `Secret` to a list of namespaces, defaulting to the controller's own namespace when enabled. For example, `cache.Options.ByObject` with `Namespaces` for `corev1.Secret`. - Add a chart value that renders namespaced Role/RoleBinding objects for secrets in those namespaces instead of the ClusterRole rule. ### Environment - apisix-ingress-controller 2.2.0 (helm chart apisix 2.16.1; the latest chart 2.18.2 still ships 2.2.0) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
