Ability to limit serviceaccount to read only specified secrets/configmaps

[simonsystem]

For security reason, we would like to restrict access for the sidecar service-account to get only one named secret with the resourceNames option.

See the following role:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: allow-only-one-secrets
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - my-holy-secret
    verbs:
      - get

Poorly, the sidecar is using the list_namespaced_secret and list_namespaced_config_map functions here. So it will result in a forbidden response from K8S-API (403).

Error from server (Forbidden): secrets is forbidden: User "system:serviceaccount:default:sidecar" cannot list resource "secrets" in API group "" in the namespace "default"

I suggest adding functionality to fetch/get only specefied secrets/configmaps from K8S-API using read_namespaced_secret and read_namespaced_config_map.

An idea would be to add another environment variable RESOURCE_NAME for having a comma-separated list of secrets/configmaps being fetched.

[simonsystem]

Duplicate of #172