[newrelic-infrastructure] Why does the cluster role require get permission for secrets?

[jasonmcboyd]

[newrelic-infrastructure] Why does the cluster role require get permission for secrets?

[paologallinaharbur]

Hello @jasonmcboyd,
I understand the concern, we are double-checking if we can drop some of these broad permissions.

[paologallinaharbur]

Hello again,
we checked and the permission is needed for example in order to fetch the secret containing ETCD TLS setting up the mutual TLS for ETCD control plane monitoring.

Usually this secret it is stored in a different namespace and this is why the broad access is needed

Documentation -> https://docs.newrelic.com/docs/integrations/kubernetes-integration/installation/configure-control-plane-monitoring#etcd

Code that access the secret in nri-kubernetes -> https://github.com/newrelic/nri-kubernetes/blob/a376f16025d0096e458a24db62c365e9a01eb491/src/controlplane/client/discovery.go#L108

---

Do you have further questions regarding permissions and why they are needed?

[paologallinaharbur]

Closing for now