traefik controller access to secrets

[spinto]

The traefik controller shall have access to secrets for the k8s basic authentication (#1488) to work

[Slahser]

yeah,i think this pr should be merged,some people fix this issue themeselves

[timoreimann]

I wonder if we should formulate this in a more conditional manner. Presumably, secrets access will only be required by those that actually use basic authentication?

[timoreimann]

Answering myself:

I wonder if we should formulate this in a more conditional manner. Presumably, secrets access will only be required by those that actually use basic authentication?

Sadly, Traefik does not conditionally watch for secrets as of now. See also #1784.

So this one seems okay.

[timoreimann]

@dtomcej @errm WDYT?

[errm]

This LGTM as an example that should work in all cases.

In practice if I were paranoid I would probably use a more granular rule here:

- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["name-of-a-secret"]
  verbs: ["get","list","watch"]

[dtomcej]

LGTM