Disable secretinformer if internal-encryption is false

[ryutoyasugi]

Describe the feature

The secretinformer was implemented in #13005 , but our k8s cluster don't have permission to view the secret of all namespaces, so we cannot start the controller.

We want to disable secretinformer when internal-encryption is false.

[psschwei]

cc @evankanderson for his thoughts

[evankanderson]

While it may be reasonable to disable the informer for now, it seems like we should scope the rights and listen call to a single secret and include that in our provided Cluster role

/cc @KauzClay @dprotaso

[skonto]

cc @nak3

[dprotaso]

Our controllers need the ability to access secrets in arbitrary namespaces in order to fetch image pull secrets for resolving image tags to digests

@ryutoyasugi are you scoping/changing the default cluster role rules to specific namespaces?

serving/config/core/200-roles/clusterrole.yaml

Lines 24 to 25 in aaa992e

	- apiGroups: [""]
	resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"]

/triage needs-user-input

[ryutoyasugi]

@dprotaso We are not changed ClusterRole. Strictly speaking, we use our own authorization system instead of ClusterRole, but uses the same rules.

I didn't know that the controllers accesses the secret to resolve image tag digests. But it's not a problem. It may be because we use our own container registry.

[dprotaso]

I didn't know that the controllers accesses the secret to resolve image tag digests. But it's not a problem. It may be because we use our own container registry.

It might be because of the following

• you reference images by digest
• you disable tag-to-digest for specific registries (configured here)
• you don't use image pull secrets and your images are public

[ReToCode]

Closing this because lack of additional input. Feel free to re-open if necessary.

/close

[knative-prow]

@ReToCode: Closing this issue.

Details

In response to this:

Closing this because lack of additional input. Feel free to re-open if necessary.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.