Feature: support secret target about trust-manager HOT 6 CLOSED

I support adding secrets as an opt-in target for bundles. There are just so many tools that only support obtaining CA certificates from secrets. And one could argue that even if a CA certificate bundle is not strictly secret, defining who you trust is definitely important for overall security.

As a mitigation to that risk, perhaps a suggestion for RBAC on secret to explicitly list resource names?

@james-callahan I don't think this is possible in general. As a user of trust-manager, I would expect to be allowed to express the secret name in the bundle resource. AFAIK the controller-runtime mechanics (and Kubernetes API) do not really support watching resources cluster-wide by name(s).

from trust-manager.

Hi @cortopy, there is no technical reason why adding Secret as a target could not be done, however is poses security implications (trust would be able read + write all Secrets in all namespaces). If added, we would likely want this feature disabled by default, and users would have to explicitly toggle that they 1. want this target available, and 2. grant and understand they are giving trust the permissions to do this.

from trust-manager.

thanks @JoshVanL for such a quick answer. I hadn't thought of that but the path you propose sounds excellent

from trust-manager.

As a mitigation to that risk, perhaps a suggestion for RBAC on secret to explicitly list resource names?

from trust-manager.

I believe is issue was fixed by #193

/close

from trust-manager.

@erikgb: Closing this issue.

from trust-manager.