rbac.secretResourceNames support removed even for namespaced deployments
status/0-needs-triage
### Welcome!
- [x] Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik-helm-chart/issues) and didn't find any.
- [x] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.
### What version of the Traefik's Helm Chart are you using?
39.0.5
### What version of Traefik are you using?
packaged within chart
### What did you expect to happen ?
rbac.secretResourceNames to keep working for namespace scoped deployments
### What did you notice instead ?
support `rbac.secretResourceNames` fully removed by https://github.com/traefik/traefik-helm-chart/pull/1683
### What are your values ?
```
rbac:
enabled: true
namespaced: true
secretResourceNames:
- tls-secret #! adjust
```
### Additional Information
https://github.com/traefik/traefik-helm-chart/pull/1683 breaks my setup.
I've been running namespaced Traefik with rbac.secretResourceNames scoped to only the TLS secret within the namespace. This has been working correctly for at least 6 months — certs were being renewed and Traefik could access them without issue.
#1653 specifically mentions cluster-scoped deployment, where restricting secretResourceNames breaks Traefik's informer because Kubernetes RBAC doesn't support resourceNames filtering on a cluster-scope list.
However, with namespaced: true, no ClusterRole is created at all — only a namespace-scoped Role. In that case, resourceNames restrictions on list work correctly because the scope is already bounded to the namespace.
Could you confirm whether removing secretResourceNames is intentional for namespaced deployments as well, or whether this was only meant to address the cluster-scoped case? If the former, it would be worth documenting that namespaced users need to manage secret RBAC manually outside of Helm or role out fix for that
0 条评论