Differently-scoped credentials per SecretRotator

[kennethredler]

Is your feature request related to a problem? Please describe.

Scoped credentials.

Describe the solution you'd like to see

I would like the secrets provisioned for two different SecretRotators by the same operator to have two different authorization scopes.

SecretRotator A might put secret N in namespaces 1-5 that only provides authorization to pull image N-Y, and NOT authorized to pull image M-Z.

Meanwhile, SecretRotator B might put secret M in namespaces 6-10 that only provides authorization to pull image M-Z, and NOT authorized to pull image N-Y.

Describe alternatives you've considered

Multiple operators selecting specific SecretRotators by label.

Manual rotation.

Distinct optional attribute of each SecretRotator containing IAM Role ARN assumable by the operator's IRSA.

Additional context

Similar pattern to ExternalSecret operator which can use an assumable role attribute on SecretStore for AWS SecretsManager and ParameterStore providers.

[oumkale]

HI @kennethredler,

Thank you for raising issue, we will look into and get back to you.