[FEATURE] Restrict secrets access to namespace

[ghost]

Is your feature request related to a problem?

Currently, ClusterRoleBindings are used to attach the ClusterRole to the service account created in the Helm Chart. Read access to the secrets API is configured in the ClusterRole. This allows a potential attacker to read secrets from all namespaces in the Kubernetes cluster.

What solution would you like?

Instead of a ClusterRoleBinding, a RoleBinding should be used to only allow access to secrets in the namespace.

What alternatives have you considered?

NONE

Do you have any additional context?

We found the same issue in the kube-prometheus-stack helm chart. Steps to reproduce the issue can be found there:
prometheus-community/helm-charts#4156

[bbung]

This also prevents us from using the operator. Our security guidelines prevent us from using external components that get cluster-wide secret access.

[salyh]

This would absolutely make sense. Thank you for your contribution.

I guess such a change would be a breaking change? Wdyt? @zaljic @bbung
@idanl21 @dbason @swoehrl-mw @prudhvigodithi @jochenkressin @pchmielnik

[swoehrl-mw]

Not sure if the access can actually be restricted. By default the operator runs cluster-wide, so needs access to resources in all namespaces.
Maybe an optional deployment mode in the helm chart which restricts the operator to just one namespace (there is some discussion about this in #584), then it would also not be a breaking change if the default remains the current cluster-wide mode.