Add secrets read-only access to RBAC

config/rbac/role.yaml

@@ -13,6 +13,14 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - source.toolkit.fluxcd.io
   resources:

controllers/bucket_controller.go

@@ -56,6 +56,7 @@ type BucketReconciler struct {
 
 // +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=buckets,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=buckets/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
 
 func (r *BucketReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
 	ctx := context.Background()