---
id: w7/m7/t001
title: Scope the operator's secrets access — namespace-scoped Role(s) / narrowed verbs instead of a cluster-wide grant
worker: worker7
status: todo
estimate: 45m
depends_on: []
---

## Objective

Replace the operator's cluster-wide unrestricted `secrets` grant with the narrowest permission that still lets it do its job: read the git clone Secret in the App/build namespaces, create/update tenant Secrets (App env, TLS, datastore credentials), and delete them on teardown. Prefer a namespace-scoped Role + RoleBinding in the apps namespace (and the build namespace if `BEX_BUILD_NAMESPACE` differs), or — if the operator must remain namespace-flexible — a tighter ClusterRole (narrowed verbs, no blanket cluster-wide `list`/`watch` of all Secrets).

## Context

- `lego/operator/config/rbac/role.yaml:6-19` — the current rule: `apiGroups:[""] resources:[secrets,services] verbs:[create,delete,get,list,patch,update,watch]`, cluster-wide.
- The RBAC is kubebuilder-generated from markers in the operator source (`+kubebuilder:rbac` comments) — change the markers and regenerate (`make manifests` from `lego/operator/`), don't hand-edit only the YAML, or the next codegen reverts it.
- Determine the operator's real Secret footprint: build clone-secret reads (`lego/operator/internal/build/`), tenant Secret writes in the controllers (app/database/keyvalue), and the namespaces they target (default apps ns + `BEX_BUILD_NAMESPACE`).
- Note: `services` is in the same rule — keep the operator's Service management intact; only the secrets breadth is the target.

## Steps

1. Enumerate the operator's actual Secret operations + target namespaces from the controller/build code.
2. Rewrite the `+kubebuilder:rbac` marker(s) to the narrowest form (namespace-scoped Role, or narrowed verbs/resources); regenerate manifests from `lego/operator/`.
3. Verify the operator still builds and that its Secret operations are covered (dev-loop or envtest where feasible).

## Files

- The operator source `+kubebuilder:rbac` markers (grep for `kubebuilder:rbac` near secrets)
- `lego/operator/config/rbac/role.yaml` (regenerated)

## Acceptance criteria

- [ ] The operator no longer holds a cluster-wide unrestricted `secrets` read; its grant is scoped to the namespaces/verbs it actually uses.
- [ ] Manifests regenerated from markers (not hand-edited); operator builds; Secret operations still covered.

## Out of scope

- bex-api RBAC (t002); the CI guard (t003).
