Revert to individual secret get

[liggitt]

This PR:

• reverts the mechanism for fetching TLS secrets to a Get() (away from listing all secrets in a namespace in https://github.com/kubernetes/ingress-gce/pull/1101/files#r456811105)
• removes the secret list permission added in https://github.com/kubernetes/ingress-gce/pull/1134/files#r456812266
• resolves the test failure reported in [Failing Test] Add List permissions for Secrets for glbc kubernetes#93031

/assign @bowei @rramkumar1

[bowei]

Is this a general policy for secrets?

[bowei]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bowei, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [bowei]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liggitt]

Is this a general policy for secrets?

it's the recommendation for controllers that are not expected to be highly privileged, see https://kubernetes.io/docs/concepts/configuration/secret/#clients-that-use-the-secret-api

For these reasons watch and list requests for secrets within a namespace are extremely powerful capabilities and should be avoided, since listing secrets allows the clients to inspect the values of all secrets that are in that namespace. The ability to watch and list all secrets in a cluster should be reserved for only the most privileged, system-level components.

Applications that need to access the Secret API should perform get requests on the secrets they need. This lets administrators restrict access to all secrets while white-listing access to individual instances that the app needs.

This recommendation came out of discussions in sig-auth specifically around ingress controller access patterns:

• https://github.com/kubernetes/community/blob/master/sig-auth/archive/meeting-notes-2017.md#july-12th-2017-11a---noon-pacific-time
• Don't watch all secrets in a namespace ingress-nginx#816