<p>The golang operator started writing an error.</p>
<p><code>failed to list v1.Secret: secrets is forbidden: User &quot;system:serviceaccount:operator-*****&quot; cannot list resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;namespace-name&quot;</code></p>
<p>The error appeared after we enabled restrictions on list secret (set resource Names).
Without restrictions, everything works fine.
I am not familiar with golang, but after looking at the source code, I came to the conclusion that the error occurs in this place</p>
<pre><code>    if err := g.client.Get(ctx, client.ObjectKey{Name: tokens.Name, Namespace: g.namespace}, &amp;tokens); err != nil {
        return nil, errors.WithMessage(err, &quot;failed to query tokens&quot;)
</code></pre>
<p>Here is a more complete part of the code</p>
<pre><code>package initgeneration

import (
    &quot;context&quot;
    &quot;encoding/json&quot;
    
    dynatracev1beta1 &quot;github.com/Dynatrace/dynatrace-operator/src/api/v1beta1&quot;
    &quot;github.com/Dynatrace/dynatrace-operator/src/config&quot;
    &quot;github.com/pkg/errors&quot;
    corev1 &quot;k8s.io/api/core/v1&quot;
    metav1 &quot;k8s.io/apimachinery/pkg/apis/meta/v1&quot;
    &quot;k8s.io/apimachinery/pkg/labels&quot;
    &quot;k8s.io/apimachinery/pkg/types&quot;
    &quot;sigs.k8s.io/controller-runtime/pkg/client&quot;
)


// InitGenerator manages the init secret generation for the user namespaces.

type InitGenerator struct {
    client        client.Client
    apiReader     client.Reader
    namespace     string
    canWatchNodes bool
    dynakubeQuery kubeobjects.DynakubeQuery
}
...

func (g *InitGenerator) createSecretConfigForDynaKube(ctx context.Context, dynakube *dynatracev1beta1.DynaKube, kubeSystemUID types.UID, hostMonitoringNodes map[string]string) (*standalone.SecretConfig, error) {
    var tokens corev1.Secret
    if err := g.client.Get(ctx, client.ObjectKey{Name: tokens.Name, Namespace: g.namespace}, &amp;tokens); err != nil {
        return nil, errors.WithMessage(err, &quot;failed to query tokens&quot;)
</code></pre>
<p>The Get method is used in the package &quot;asus.k8s.io/controller-runtime/pkg/client &quot; , when accessing the K8S API, it requests all the secrets and only then imposes a filter.
I need to get around this limitation
How to get secrets, how to access the K8S API through the client package with a restriction on resourceName?</p>

Sergey Belov
<p>Controller-runtime client ( &quot;sigs.k8s.io/controller-runtime/pkg/client&quot;) goes to its cache when receiving a request, and it updates the cache through the watch operation, i.e. it needs access to all secrets</p>
<p>The solution that helped: disable cache for secrets in &quot;Options&quot;
<a href="https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/manager#Options" rel="nofollow noreferrer">https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/manager#Options</a></p>
<p>via ClientDisableCacheFor</p>
<pre><code>func (provider operatorManagerProvider) createOptions(namespace string) ctrl.Options {
    return ctrl.Options{
        Namespace:                  namespace,
        Scheme:                     scheme.Scheme,
        MetricsBindAddress:         metricsBindAddress,
        Port:                       operatorManagerPort,
        ...
        ClientDisableCacheFor: []client.Object{
            &amp;corev1.Secret{},
        },
    }
}
</code></pre>
