I am installing External Secrets Operator (ESO) into EKS cluster.

My goal is to give as little privileges to the operator as possible, preferably limited to a namespace.
The ESO official docs mention the option of installing ESO per namespace to properly limit access of ESO to specific namespaces. I think this option would consume too many resources and would be difficult to maintain.

I installed the ESO to namespace eso with Helm and defined scopedRBAC: true and scopedNamespace: my-namespace in values. Later I created Role and RoleBinding in the namespace app specifying the service account from the eso namespace but it didn´t work.

I also tried installation with the default values and modified external-secrets-controller ClusterRole. From the ClusterRole, I removed secrets and external-secrets and created Role and RoleBinding in each namespace which has permissions to manage secrets and external-secrets. This method didn´t work out because the operator was complaining that it did not have permission to create secrets.

Here is the original ClusterRole I modified:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: external-secrets-controller
  labels:
    helm.sh/chart: external-secrets-0.9.20
    app.kubernetes.io/name: external-secrets
    app.kubernetes.io/instance: external-secrets
    app.kubernetes.io/version: "v0.9.20"
    app.kubernetes.io/managed-by: Helm
rules:
  - apiGroups:
    - "external-secrets.io"
    resources:
    - "secretstores"
    - "clustersecretstores"
    - "externalsecrets"
    - "clusterexternalsecrets"
    - "pushsecrets"
    verbs:
    - "get"
    - "list"
    - "watch"
  - apiGroups:
    - "external-secrets.io"
    resources:
    - "externalsecrets"
    - "externalsecrets/status"
    - "externalsecrets/finalizers"
    - "secretstores"
    - "secretstores/status"
    - "secretstores/finalizers"
    - "clustersecretstores"
    - "clustersecretstores/status"
    - "clustersecretstores/finalizers"
    - "clusterexternalsecrets"
    - "clusterexternalsecrets/status"
    - "clusterexternalsecrets/finalizers"
    - "pushsecrets"
    - "pushsecrets/status"
    - "pushsecrets/finalizers"
    verbs:
    - "get"
    - "update"
    - "patch"
  - apiGroups:
    - "generators.external-secrets.io"
    resources:
    - "acraccesstokens"
    - "ecrauthorizationtokens"
    - "fakes"
    - "gcraccesstokens"
    - "githubaccesstokens"
    - "passwords"
    - "vaultdynamicsecrets"
    - "webhooks"
    verbs:
    - "get"
    - "list"
    - "watch"
  - apiGroups:
    - ""
    resources:
    - "serviceaccounts"
    - "namespaces"
    verbs:
    - "get"
    - "list"
    - "watch"
  - apiGroups:
    - ""
    resources:
    - "configmaps"
    verbs:
    - "get"
    - "list"
    - "watch"
  - apiGroups:
    - ""
    resources:
    - "secrets"
    verbs:
    - "get"
    - "list"
    - "watch"
    - "create"
    - "update"
    - "delete"
    - "patch"
  - apiGroups:
    - ""
    resources:
    - "serviceaccounts/token"
    verbs:
    - "create"
  - apiGroups:
    - ""
    resources:
    - "events"
    verbs:
    - "create"
    - "patch"
  - apiGroups:
    - "external-secrets.io"
    resources:
    - "externalsecrets"
    verbs:
    - "create"
    - "update"
    - "delete"

Does anyone know if it is possible to achieve cluster-wide installation of External Secret Operator with namespace scoped permission to manage secrets and external-secrets?