RBAC policy for watching a single object?

[justinsb]

Related to #43299, what is the RBAC policy to lock down watching to a particular object (in my case, a secret)?

I've tried:

- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get","watch","list"]
  resourceNames: ["singleton"]

But that gives me "...cannot list secrets..."

It seems to need:

- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get","watch","list"]

This is using:

listOpts.FieldSelector = fields.OneTermEqualSelector("metadata.name", c.name).String()

[justinsb]

cc @liggitt

[liggitt]

authorization doesn't currently doesn't have the filter attributes on list/watch calls, so those are authorized unscoped to a particular resource name. that applies to all authorizers, not just RBAC

adding support for that is one aspect of #40403

[debianmaster]

@liggitt now that custom resources are in use extensively , it will be nice to have a built-in solution for filtering custom objects based on k8s native RBAC. any workarounds that you can suggest?

• Admission controllers [ no get operations supported AFAIK]
• Pass all the objects in get operations and get only objects to which impersonated user has access to?

[liggitt]

watch/list support for single resources was added in #63469 in v1.11

The list/watch requests must set a fieldSelector of metadata.name=$name