Restrict access to secrets in K8S cluster

[jnonino]

Welcome!

• [X] Yes, I've searched similar issues on GitHub and didn't find any.
• [X] Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you expect to see?

Currently RBAC permissions created for Traefik gives access to all secrets with no restrictions. As defined in rbac/clusterrole.yaml#L31 and rbac/role.yaml#L21.

  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch

That generates security concerns as Traefik should not need access to every secret in the cluster. The idea should be to have a parametrized field in the secrets permissions to use resourceNames and give Traefik access only to the secrets it might require to work.

[mloiseleur]

Hello @jnonino,

That's right. It can be improved on this point. Thanks for this issue.

[jnonino]

Cool, I'll work on a pull request for it!

[mloiseleur]

:warning: Don't forget that TLS certificates can be stored in Secrets, for instance when using cert-manager.

[jnonino]

Sure, we are actually using it that way!

[jnonino]

New PR opened: https://github.com/traefik/traefik-helm-chart/pull/1009

[jnonino]

For more context, tools like Wiz found issues with the Traefik container.

Restrictions on secret access will help to reduce the risk of issues with sensitive information.

[mloiseleur]

Fixed with

• #1009