In order for Cluster API to support provisioning clusters across namespaces that require unique cloud credentials and to write guest cluster credentials, Secret RBAC permissions are scoped broadly cluster-wide. Generally, Cluster API and providers are operated in a trusted context (i.e. the management cluster). However, there are strategies to run Cluster API controllers per tenant namespace to scope down Secrets access.
To support namespace scoped CAPOx, we would need to implement a flag on the controller that tells CAPOx which namespace(s) to watch and replace the ClusterRole Secrets RBAC permissions to individual Role permissions for each namespace that CAPOx watches.
In order for Cluster API to support provisioning clusters across namespaces that require unique cloud credentials and to write guest cluster credentials,
SecretRBAC permissions are scoped broadly cluster-wide. Generally, Cluster API and providers are operated in a trusted context (i.e. the management cluster). However, there are strategies to run Cluster API controllers per tenant namespace to scope downSecretsaccess.To support namespace scoped CAPOx, we would need to implement a flag on the controller that tells CAPOx which namespace(s) to watch and replace the ClusterRole Secrets RBAC permissions to individual Role permissions for each namespace that CAPOx watches.