Rule-based secret selector

[nightkr]

Rather than naming the secret explicitly (#1), a Volume should be matchable to a Secret based on dynamic criteria (such as the pod name, controller object, service name, node name, and so on).