k8sSearch: exclude secrets with scopes that are not requested #556
Description
Affected Stackable version
nightly
Current and expected behavior
Currently, the k8sSearch backend treats requested scopes as a minimum bound. A volume that requests pod will happily be supplied a secret secret that provides pod,node, allowing the pod to impersonate someone else.
Possible solution
k8sSearch should reject secrets that specify unrequested scopes.
Additional context
No response
Environment
No response
Would you like to work on fixing this bug?
None