## Operator SA granted read on all Secrets in openshift-config namespace

**CWEs:** CWE-269, CWE-732
**CVSS:** 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
**Component:** openshift-5.0-payload/cluster-samples-operator__release-5.0

### Description
The Role coreos-pull-secret-reader in namespace openshift-config grants get/list/watch on the entire secrets resource without a resourceNames restriction. The operator only ever reads the single Secret named 'pull-secret' (pkg/metrics/metrics.go:182, pkg/client/listers.go ConfigNamespaceSecrets informer). openshift-config holds high-value cluster credentials including OAuth IdP client secrets, htpasswd files, additional CA bundles, and cloud-provider credentials, so a compromise of the samples-operator pod or its token yields read access to all of them.

### Affected Locations
- `:`

### Evidence
**manifests/05-kube-system-rbac.yaml:10-18 — no resourceNames scoping**
```yaml
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
```

### Attack Pattern
Code-exec or token theft in the samples-operator pod → list/get every Secret in openshift-config → exfiltrate IdP/OAuth/cloud credentials.

---
*Source: Ex-Wing security assessment, finding FIND-001*