Allow DopplerSecret to be deployed to other namespaces

[kzap]

@nmanoogian I saw:

• Shouldn't allow DopplerSecret in another namespace access doppler-operator-system namespace secrets #21
• ENG-4564: Require dopplersecret resources to be in operator namespace #22

and would have preferred having the option to limit DopplerSecret to a specific namespace or even only reading tokens from the same namespace

it seems counter intuitive to the namespacing of kubernetes. The DopplerSecret should be able to reconcile be deployed to other namespaces. its the cross namespace access that was problematic allowing non operators to enumerate or access secrets that they did not have access to

I have a Doppler Token and own it and I am an application owner, I have to coordinate with the team that deploys the Doppler Operator to deploy my DopplerSecret just so that my namespace can have a secret. It seems we are artificially limiting who can manage DopplerSecret

External Secrets Operator would also allow also me to do it this way using SecretStore and Secret in the same namespace so I would suggest having Doppler Operator mimic that ability.

Thank you for your time :)

[nmanoogian]

Hi @kzap, thanks for your feedback on this! We had some similar discussions about multi-tenancy over in #28.

We're still working internally to identify the best access control pattern for the operator. I'll follow up here with any details.