[FEATURE] Limit secrets permissions

[consooo]

The problem
The clusterrole for the reverser always needs these broad secrets permissions

- apiGroups: [""]
  resources: ["secrets"]
  verbs: [get, list, watch]

even if it shouldn't sync any secrets.

The solution
add a flag --secret-namespaces=ns1,ns2 that would restrict the cache for secrets to namespaces. Then we could add a Role + RoleBinding for these namespaces. This would significantly reduce the blast radius.
For us, we don't want to watch secrets so we could put only the gitrepo secret in this namespace.

[sunib]

Thanks for bringing this up: this is not how it should be. Effectively I'm now keeping every secret in the cluster in my memory, also when there is is not a real reason. I will pick this up as one of the first things. I would even take it one step further: the only reason to have a cluster wide watch on secrets is when you - for whatever reason - configure a ClusterWatchRule that wants to write all secrets.

[sunib]

I have just merged a change set that's should fix the source code side of things, I've removed caching of secrets, and I've also removed watch for the "control-plane" side of things. Obviously you will still need a watch if you want to mirror secrets into git which in your case doesn't apply. I did some refactoring in the main push path so that it's not constantly retrieving secrets. No way that this is overwhelming your kube-api.

From the level of your questions/suggestions I'm guessing that you are writing your own RBAC, so I didn't bother to make the helm chart more advanced on this (which could become a seperate PR, but for the now I'm suggesting to not do that).

[consooo]

Awesome! And so fast. Thank you 🙏