Veeam Kasten - Join Token Read User

Hi,

I am using the multi cluster management feature of veeam kasten and currently implementing GitOps based deployment for it.

In order to join secondary clusters to primary I need to be able to fetch the join token from a secondary cluster using the dashboard API (no Kube API access): https://<fqdn>/k10/dashboardbff-svc/v0/mc/joinTokens

I was able to provide access to it by this role and the corresponding rolebinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: k10-mc-join-token-reader
  namespace: kasten-io-mc
rules:
- apiGroups:
  - ""
  resources:
  - secrets
#  resourceNames:
#  - dev-cluster
#  - staging-cluster
#  - prod-cluster
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cluster-join-token-readers
  namespace: kasten-io-mc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: k10-mc-join-token-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: system:serviceaccount:kasten-io-mc:mc-join-token-reader

Is there any possibility to prevent access to all secrets in the multi cluster namespace (kasten-io-mc)?

As you can see resourceNames are currently commented out. As soon as I limit access to only specific join token secrets the request fails with a 403 Unauthenticated:

curl --fail   --request GET   --header "Authorization: Bearer $(oc get secret mc-join-token-reader-sa -n kasten-io-mc -o jsonpath='{.data.token}' | base64 -d)"   --url "https://<fqdn>/k10/dashboardbff-svc/v0/mc/joinTokens"
curl: (22) The requested URL returned error: 403

Without resourceNames definition everything works out:

curl --fail   --request GET   --header "Authorization: Bearer $(oc get secret mc-join-token-reader-sa -n kasten-io-mc -o jsonpath='{.data.token}' | base64 -d)"   --url "https://<fqdn>/k10/dashboardbff-svc/v0/mc/joinTokens"
[{"createdAt":"2026-09-16T05:22:37.000Z","name":"dev-cluster","token":"<redacted>"},{"createdAt":"2026-09-16T12:50:50.000Z","name":"staging-cluster","token":"<redacted>"}, ...]

Is it possible to limit access to either specific join-tokens or all join-tokens, without explicitly allowing access to all secrets with a user or service account?

Thanks and BR,

Philipp