Why do kube-state-metrics clusterrole need access to list,watch all secrets at cluster scope?

[dsai1]

An issue was raised by our security team saying the existing kube-state-metrics cluster role has access to all secrets.

Below is the AVD-KSV-0041, which is blocking our pipeline as part of trivy checks.

Can we restrict access to specified secrets?

[CatherineF-dev]

It collects secret metrics.

Can we restrict access to specified secrets?

You can remove this permission if don't need secret metrics.

[dashpole]

/assign @CatherineF-dev /triage accepted

[CatherineF-dev]

1. drop secret related metrics using allowlist/denylist https://github.com/kubernetes/kube-state-metrics/blob/main/docs/cli-arguments.md

2. remove secret permission

Do you have other questions? If not, will close

[CatherineF-dev]

/close

[k8s-ci-robot]

@CatherineF-dev: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.