fix(rbac): restore secretResourceNames for namespaced Role - #1972
Open
HarnageaGabriel wants to merge 2 commits into
Open
fix(rbac): restore secretResourceNames for namespaced Role#1972HarnageaGabriel wants to merge 2 commits into
HarnageaGabriel wants to merge 2 commits into
Conversation
PR traefik#1683 removed rbac.secretResourceNames entirely because Kubernetes RBAC does not support resourceNames on a ClusterRole's list/watch rules, which broke Traefik's secret informer when rbac.namespaced is false. That removal also dropped the value for the namespaced (Role) case, where resourceNames on a Role works correctly and lets users restrict Traefik's secret access to a single secret (e.g. its TLS certificate) instead of every secret in the namespace. Restore rbac.secretResourceNames, applied only to templates/rbac/role.yaml. templates/rbac/clusterrole.yaml is untouched so cluster-scoped RBAC keeps unrestricted secret access as fixed by traefik#1683. Fixes traefik#1745 Signed-off-by: HarnageaGabriel <gabriel.harnagea06@gmail.com>
mloiseleur
reviewed
Aug 19, 2026
| | rbac.aggregateTo | list | `[]` | Enable user-facing roles https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles | | ||
| | rbac.enabled | bool | `true` | Whether Role Based Access Control objects like roles and rolebindings should be created | | ||
| | rbac.namespaced | bool | `false` | When set to true: <br /> 1. It switches respectively the use of `ClusterRole` and `ClusterRoleBinding` to `Role` and `RoleBinding`.<br /> 2. It adds `disableClusterScopeResources` on Ingress and CRD (Kubernetes) providers<br /> **NOTE**: `IngressClass`, `NodePortLB` and **Gateway** provider cannot be used with namespaced RBAC. <br /> See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#opt-providers-kubernetesIngress-disableClusterScopeResources) for more details. | | ||
| | rbac.secretResourceNames | list | `[]` | List of Kubernetes secrets that are accessible for Traefik when `rbac.namespaced` is true. If empty, then access is granted to every secret. Ignored when `rbac.namespaced` is false (ClusterRole), since Kubernetes RBAC does not support `resourceNames` on cluster-scoped list/watch rules. | |
Member
There was a problem hiding this comment.
Ignored when
rbac.namespacedis false (ClusterRole), since Kubernetes RBAC does not supportresourceNameson cluster-scoped list/watch rules.
Would you please add a fail-fast check in requirements.yaml for better UserXP?
Author
There was a problem hiding this comment.
Added — see 4acafff: requirements.yaml now fails template rendering when rbac.secretResourceNames is set while rbac.namespaced is false, with message ERROR: rbac.secretResourceNames requires rbac.namespaced to be true. Kubernetes RBAC does not support resourceNames on cluster-scoped list/watch rules. Follows the same fail pattern as the other checks in that file. Covered by new tests in requirements-config_test.yaml (invalid combo fails, valid combo passes).
…ed RBAC rbac.secretResourceNames was silently ignored when rbac.namespaced is false, since Kubernetes RBAC does not support resourceNames on cluster-scoped list/watch rules. Add a requirements.yaml check to surface this at template/install time instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Restores
rbac.secretResourceNames, but scoped only to the namespacedRolecase (rbac.namespaced: true).templates/rbac/clusterrole.yamlis left untouched.Why
#1683 removed
rbac.secretResourceNamesentirely to fix a real bug: Kubernetes RBAC does not supportresourceNameson aClusterRole's list/watch rules, so setting it broke Traefik's secret informer whenrbac.namespaced: false.That fix over-removed the value: when
rbac.namespaced: true, Traefik only gets a namespacedRole(not aClusterRole), andresourceNameson aRoleworks correctly. Restricting it to one secret (e.g. Traefik's own TLS certificate) instead of every secret in the namespace is a legitimate, useful restriction that #1683 removed as collateral damage.The maintainer confirmed this direction in the issue: re-implement a version of
secretResourceNamestailored for the namespaced use case.Changes
traefik/templates/rbac/role.yaml: re-add the conditionalresourceNamesblock for the secrets rule (same logic fix: removerbac.secretResourceNames#1683 removed).traefik/templates/rbac/clusterrole.yaml: unchanged — cluster-scoped RBAC keeps unrestricted secret access, per fix: removerbac.secretResourceNames#1683.traefik/values.yaml: re-addrbac.secretResourceNames: [], with an updated doc comment clarifying it only applies whenrbac.namespaced: true.traefik/values.schema.json,traefik/VALUES.md: regenerated viahelm schema/helm-docs.traefik/tests/rbac-config_test.yaml: re-add only the twoRole-scoped test cases from fix: removerbac.secretResourceNames#1683's removed tests (empty vs. setsecretResourceNamesunderrbac.namespaced: true). NoClusterRoletest cases are re-added.Test plan
helm unittest -f tests/rbac-config_test.yaml traefik— 41/41 pass, including the 2 newRolecases.helm unittest ./traefik(full suite) — same 47 pre-existing, unrelated failures as onmaster(tracing/otlp arg formatting), zero regressions from this change (708 passed vs. 706 onmaster, the +2 being the new tests).templates/rbac/clusterrole.yamlrenders identically tomaster(noresourceNamesfor secrets inClusterRole, regardless ofsecretResourceNames).Fixes #1745