Re: [I] feat: Is it possible to make the ingress controller work without allowing read access to all secrets in the cluster? [apisix-ingress-controller]

["4FunAndProfit (via GitHub)" <gi...@apache.org>]

4FunAndProfit commented on issue #2138:
URL: https://github.com/apache/apisix-ingress-controller/issues/2138#issuecomment-2238798427

   Hi @Revolyssup, i tried your recommandation here: https://github.com/apache/apisix-ingress-controller/issues/2138#issuecomment-1899808129
   
   Yet, when we do Secrets via per-namespace Role and RoleBinding instead of ClusterRoleBinding and ClusterRole we have an error: 
   ```
   E0719 17:49:20.123223       1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.28.2/tools/cache/reflector.go:229: Failed to watch *v1.Secret: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:apisix-ingress-dev:apisix-view-serviceaccount" cannot list resource "secrets" in API group "" at the cluster scope
   ```
   
   Note that we have the same error for a a lot of rule not only for secrets (configmap, etc) if we try to get it work with a rolebinding.
   
   Is it possible to reopen this issue and make it work with rolebinding?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org