feat: disable caching for v1.secrets, avoid listing secrets cluster w…

…ide (#217) Co-authored-by: Barahona José Luis (IT-PTR-BDE16) <jose_luis.barahona@sbb.ch>
redhat-cop · May 19, 2023 · efd060b · efd060b
1 parent e454ce0
commit efd060b
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -19,8 +19,6 @@ rules:
   - secrets
   verbs:
   - get
-  - list
-  - watch
 - apiGroups:
   - redhatcop.redhat.io
   resources:

diff --git a/controllers/groupsync_controller.go b/controllers/groupsync_controller.go
@@ -51,7 +51,7 @@ type GroupSyncReconciler struct {
 // +kubebuilder:rbac:groups=redhatcop.redhat.io,resources=groupsyncs,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=redhatcop.redhat.io,resources=groupsyncs/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=user.openshift.io,resources=groups,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=secrets,verbs=get
 // +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch
 
 func (r *GroupSyncReconciler) Reconcile(context context.Context, req ctrl.Request) (ctrl.Result, error) {

diff --git a/main.go b/main.go
@@ -18,7 +18,9 @@ package main
 
 import (
 	"flag"
+	v1 "k8s.io/api/core/v1"
 	"os"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"time"
 
 	userv1 "github.com/openshift/api/user/v1"
@@ -86,6 +88,7 @@ func main() {
 
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:                     scheme,
+		ClientDisableCacheFor:      []client.Object{&v1.Secret{}},
 		MetricsBindAddress:         metricsAddr,
 		Port:                       9443,
 		HealthProbeBindAddress:     probeAddr,
-Original file line number
+Diff line change
@@ Expand Up / @@ -19,8 +19,6 @@ rules: @@
       - secrets
       verbs:
       - get
-      - list
-      - watch
     - apiGroups:
       - redhatcop.redhat.io
       resources:
@@ Expand Down @@