kedacore
Keda v2.15.1 cannot list secrets within the keda namespace
If the permissions.operator.restrict.secret value is set to true, the minimal-rbac.yaml will not have permissions to read the secret within the release namespace. https://github.com/kedacore/charts/blob/1373262f4a262502cbfd4f4c8fd31148d6a48e20/keda/templates/manager/minimal-rbac.yaml#L30-L37
Expected Behavior
It should be properly configured to read the secret created within its namespace.
Actual Behavior
At runtime, the keda-operator logs:
1 reflector.go:147] k8s.io/client-go/informers/factory.go:159: Failed to watch *v1.Secret: failed to list *v1.Secret: secrets is
forbidden: User "system:serviceaccount:keda:keda-operator" cannot list resource "secrets" in API group "" in the
namespace "keda"
Steps to Reproduce the Problem
- Set the values for v2.15.1 to define permissions.operator.restrict.secret to true
- Deploy the helm chart to the cluster
- Tail the logs for errors
Specifications
- KEDA Version: v2.15.1
- Platform & Version: AWS EKS v1.30
- Kubernetes Version: v1.30
Note that an unreleased pull request added more permissions to list and watch. When will this be released?
https://github.com/kedacore/charts/blob/main/keda/templates/manager/minimal-rbac.yaml#L37-L40
It looks like #625 caused a regression
To be clear, the informer only needs list/watch access, not read (get) access to secrets.
See #605 and https://github.com/kedacore/keda-docs/issues/1307 for previous discussion about how to restrict access to secrets, which I think now (after #625) probably needs an update
On slack: https://kubernetes.slack.com/archives/C01JGDP8MB8/p1726170644218529
