run with reduced permissions (Role instead of ClusterRole)

[wdw-jst]

run with reduced permissions (Role instead of ClusterRole)

[mittwald-machine]

There has not been any activity to this issue in the last 14 days. It will automatically be closed after 7 more days. Remove the stale label to prevent this.

[martin-helmich]

Thanks for the report 👍 and sorry for the late response. 🙄🙏 This might be one of these issues that are more complicated than they first appear. 🤯 Some thoughts:

1. The entire replicator was designed with the goal in mind to replicates resources across namespaces. By definition, it'll need read/write access to multiple namespaces for that. Using the replicator in a single namespace was never the intended use case, since in that case you won't need it for most of the use cases it was designed to solve.
2. Apart from using a ClusterRoleBinding to grant access to all namespaces, granting access to a select subset of namespaces should also be possible using a ClusterRole (or multiple Roles in different namespaces) with different namespaced RoleBindings.
3. HOWEVER, the replicator in its current state won't play along with that, because it sets up its informers using un-namespaced WATCH and LIST calls to the replicated resources (like the configmap replicator here), which still require cluster-wide access. To support multiple-namespaces, the replicator would need to be refactored to use multiple informers (one for each namespace), which would further complicate replication logic.

Realistically, I don't see us finding the resources to implement a major change like this one anytime soon. However, PRs are always welcome. 🙂