OBC provisioning requires permissions on any Secrets and ConfigMaps in the cluster

[guymguym]

The problem is that this is a very intrusive permission to request on a cluster, but without it the operator would not be able to reconcile an OBC on any namespace and make the secret/CM for the application.

[jeffvance]

From the rook common example for RBAC:

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: rook-ceph-object-bucket
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rook-ceph-object-bucket
subjects:
  - kind: ServiceAccount
    name: rook-ceph-system
    namespace: rook-ceph

Is this too powerful for typical cluster operator?