Incomplete restrict secret access description

[joebowbeer]

The existing documentation for restricting secret access is misleading, as it implies that access to secrets can be (completely) restricted by removing the secrets resource from one ClusterRole rule.

In addition to improving the documentation, it would be helpful if the docs explained how to update the role in order to completely restrict access.

I installed KEDA with access to secrets omitted as described in the docs:

https://keda.sh/docs/2.13/operate/cluster/#restrict-secret-access

but keda-operator still has "get" access to all secrets by way of a different rule in the keda-operator ClusterRole:

- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - get

Discussion: kedacore/keda#4730

Related: kedacore/charts#605

Expected Behavior

kubectl auth can-i get secrets --as=system:serviceaccount:keda:keda-operator
no

Actual Behavior

kubectl auth can-i get secrets --as=system:serviceaccount:keda:keda-operator
yes

Steps to Reproduce the Problem

1. Install KEDA
2. Omit secrets as documented
3. Run kubectl auth can-i get secrets

Specifications

• KEDA Version: 2.13.0

[JorTurFer]

Thanks for reporting,

- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - get

This permission is required because KEDA can potentially work with any resource which implements /scale, so it needs that permission for working. The filter is done inside the code at some different levels:

• at logic level, we don't read the secret: https://github.com/kedacore/keda/blob/main/pkg/scaling/resolver/scale_resolvers.go#L402
• at client level, we register the secret lister namespace: https://github.com/kedacore/keda/blob/main/cmd/operator/main.go#L210

To avoid the * , you can update that permission adding the other permissions required for your workloads, if you just use Deployments, replacing it with

- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get"]

Given that, I think that this can be a good improvement to docs, are you willing to open a PR clarifying it?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.