Open
Description
Stemming from #2524 (comment).
With an understanding that in a Multi-DC setup granting all verbs access across secrets and configmaps in all namespaces means effectively granting unconditional cluster-admin to the RemoteKubernetesCluster representing the remote DC, there is a need to empower the users of automated multi-DC to grant a narrower set of permissions to the control-plane cluster.
Acceptance Criteria
- It is possible to run automated multi-DC with API access to a remote k8s cluster limited to a predefined set of namespaces.
- It is possible restrict that access down to a small set of secret/configmap names to guarantee prevention of injection of config into 3rd party apps in the cluster (or even in the specified namespace - that can be running 3rd party components, like a service mesh).