Baoyuantop commented on issue #935: URL: https://github.com/apache/apisix-helm-chart/issues/935#issuecomment-6099003819
This permission belongs to APISIX Ingress Controller. The controller reads Secrets such as TLS certificates and client CAs, and watches Secret updates to reconcile resources that reference them. The latest standalone Chart 1.4.0 / Controller 2.2.0 still grants cluster-wide get/list/watch access, without granting Secret write or delete permissions. The manager currently does not restrict its namespace watch scope, which is why the chart uses a ClusterRole and ClusterRoleBinding. This does not mean every deployment functionally needs access to all Secrets. Replacing the authorization with a Role alone does not change the controller watch scope and may cause list/watch requests to be denied. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
