Ability to limit serviceaccount access to one secret only

[simonsystem]

For security reason, we would like to restrict access for the sidecar service-account to get only one named secret with the resourceNames option.
See the following role:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: allow-only-one-secrets
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - my-holy-secret
    verbs:
      - get
      - watch

Poorly, the sidecar is using the list_namespaced_secret function here. So it will result in a forbidden response from K8S-API.

Error from server (Forbidden): secrets is forbidden: User "system:serviceaccount:default:sidecar" cannot list resource "secrets" in API group "" in the namespace "default"

We suggest adding functionality to fetch/get only one secret from K8S-API using read_namespaced_secret.