H-1 from Project Glasswing security audit of hawtio-operator. The ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. The controller-runtime label-selector cache is a memory optimisation only; the SA token authorises GET/LIST on every Secret. Compromise of the operator pod yields read of every Secret in the cluster. Source: hawtio-operator-security-audit.json#H-1.