fix(rbac): fail fast when secretResourceNames is set without namespaced RBAC

rbac.secretResourceNames was silently ignored when rbac.namespaced is
false, since Kubernetes RBAC does not support resourceNames on
cluster-scoped list/watch rules. Add a requirements.yaml check to
surface this at template/install time instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: HarnageaGabriel

traefik/templates/requirements.yaml

@@ -39,6 +39,10 @@
   {{- end }}
 {{- end }}
 
+{{- if and (not .Values.rbac.namespaced) (not (empty .Values.rbac.secretResourceNames)) }}
+  {{- fail "ERROR: rbac.secretResourceNames requires rbac.namespaced to be true. Kubernetes RBAC does not support resourceNames on cluster-scoped list/watch rules." }}
+{{- end }}
+
 {{- range $name, $config := .Values.ingressRoute }}
   {{- if regexMatch "[A-Z]" $name }}
     {{- fail (printf "ERROR: ingressRoute key %q contains uppercase characters and would generate an invalid Kubernetes resource name (RFC 1123 requires lowercase)." $name) }}

traefik/tests/requirements-config_test.yaml

@@ -424,6 +424,23 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "ERROR: Kubernetes Gateway provider requires ClusterRole. RBAC cannot be namespaced."
+  - it: should fail when setting rbac.secretResourceNames without namespaced RBAC
+    set:
+      rbac:
+        namespaced: false
+        secretResourceNames:
+          - traefik-tls-cert
+    asserts:
+      - failedTemplate:
+          errorMessage: "ERROR: rbac.secretResourceNames requires rbac.namespaced to be true. Kubernetes RBAC does not support resourceNames on cluster-scoped list/watch rules."
+  - it: should not fail when setting rbac.secretResourceNames with namespaced RBAC
+    set:
+      rbac:
+        namespaced: true
+        secretResourceNames:
+          - traefik-tls-cert
+    asserts:
+      - notFailedTemplate: {}
   - it: should fail when trying to use certResolvers
     set:
       certResolvers: