kubernetesTalosAPIAccess grants all lsited roles to all listed namespaces?

[camaeel]

kubernetesTalosAPIAccess in machinConfig grants access to every workload running in every of the listed namespaces all the listed roles.
It could be made more granular, so it would be possible to define that namespace A has os:Read access, and namespace B has os:admin. Currently if I want to use talosc API access I will grant at the end os:admin to both namespaces even if only one of them requires admin privileges.

[frezbo]

This is by design, the machine config specifies the highest permissions a namespace may allow, but workload access is controlled by ServiceAccount/talos.dev/v1alpha1 CRD

apiVersion: talos.dev/v1alpha1
kind: ServiceAccount
metadata:
    name: talos-api-access-talos-secrets
spec:
    roles:
        - os:reader

in the example above even if machine config allows os:admin the secret would only have access to os:reader

[camaeel]

As far as all those workloads are controller by the "infra" team then it is ok. And I can't imagine right now a use case where talos API is exposed to tenants in multitenant environment.