As you can see here, `collins-operator` is purported to have "GET ALL IN ALL NAMESPACES", but if you look at the policy in question (below), you'll see that it actually has limited scope.
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- get
- list
- watch
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- apiGroups:
- metal3.io
resources:
- '*'
verbs:
- get
- create
- list
As you can see here, `collins-operator` is purported to have "GET ALL IN ALL NAMESPACES", but if you look at the policy in question (below), you'll see that it actually has limited scope.