title: Helm deployment without the right to list secrets
body: <p>I'm trying to deploy an application using Helm from an Azure DevOps pipeline to a private Kubernetes cluster. I've setup a rolebinding that does not include listing of secrets or getting them (it does have <code>create</code>, <code>update</code> , <code>patch</code> and <code>delete</code> on secrets to deploy them). I'd like to keep the rolebindings for this as tight as possible.</p>
  <p>But in the current deployment an error occurs:</p>
  <pre><code>query: failed to query with labels: secrets is forbidden: User &quot;system:serviceaccount:my-namespace:my-service-account&quot; cannot list resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;my-namespace&quot;
  </code></pre>
  <p>Helm is (probably) trying to read the sh.helm.release.* secrets to determine the current state of the application.</p>
  <p>Obviously, I could just add the <code>list</code> and <code>get</code> for secrets in the role, but I'd rather not, because that would also grant access to other secrets.</p>
  <p>Two questions:</p>
  <ol>
  <li>Is there a way to deploy a helm chart without granting <code>list</code> (and probably <code>get</code>) for secrets?</li>
  <li>What is exactly in these secrets? I've examining them, but it's binary. I think the data used to be in a normal ConfigMap. Is it wise / possible to go back to using ConfigMaps for this data?</li>
  </ol>
  <p>Thanks for any help.</p>
  <p>Q.</p>