WIP: rbac: controllers: narrow down permissions #1804
Conversation
Add controller watches for the resources required for network policies and metric support Signed-off-by: Francesco Romani <fromani@redhat.com>
Instead of conflating all the RBAC annotations in the controller, which was a historical artifact, we should either centralize them, or do the opposite and split them and move close to the user. The easiest path is the second one as the first one requires a deeper redesign, so this PR implements it. Signed-off-by: Francesco Romani <fromani@redhat.com>
Narrow down the permissions the controllers need to have against the core resources. Basically the controllers need read-only access to the spec and own the status subresource, so fix the RBAC rules accordingly. Signed-off-by: Francesco Romani <fromani@redhat.com>
|
/hold |
openshift-ci
bot
added
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ffromani The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
reduce the RBAC permissions from unnecessariy cluster scope to namespace scope. The operator owns only the resources in its own namespace, not in the cluster. This tightens security. Signed-off-by: Francesco Romani <fromani@redhat.com>
ffromani
force-pushed
the
rbac-review-2
branch
from
72c7649 to
03f1798
Compare
|
@ffromani: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
narrow down RBAC permissions in two ways:
The PR is reviewable but should be merged post the 4.20 cutoff, and we need to careful test it works with different namespaces - I'm testing using the default
numaresourcesnamespace. The expectation is it does, but we need to verify both the component contracts and the actual behavior.