This is a tracker to consider the idea of a subresource for object metadata. In particular, for Secrets, you may want to grant a controller permission to read/edit metadata without granting access to the data.

Forked from https://github.com/kubernetes/community/pull/1163/files#r143342579:

@smarterclayton wrote:

Somewhat of a red flag in that it gives those controllers access to all secrets in the system.

@bgrant0607 wrote:

If we're concerned about permissions, we could create a subresource for updating ownerReferences, finalizers, and possibly other metadata in order to facilitate lifecycle management without privilege escalation.