Remove unnecessary pods RBAC permissions - #957
Conversation
|
Build failed (check pipeline). Post ✔️ telemetry-openstack-meta-content-provider-master SUCCESS in 30m 33s |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abays, stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
|
recheck |
|
Build failed (check pipeline). Post ✔️ telemetry-openstack-meta-content-provider-master SUCCESS in 2h 51m 10s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ telemetry-openstack-meta-content-provider-master SUCCESS in 3h 15m 19s |
The workload rbacRules and kubebuilder RBAC markers granted the operator and its workload service accounts full CRUD (create/delete/ get/list/patch/update/watch) on core Pods. Most of these components never read or write Pod objects directly, so the unused grants are removed. Two exceptions are kept, scoped down to what is actually used: - Ceilometer deploys a kube-state-metrics StatefulSet running as its workload service account, which genuinely needs get;list;watch on Pods to produce kube_pod_status_* metrics. Keep that rbacRules grant (scoped to get;list;watch, dropping the unused write verbs), and add the matching kubebuilder marker so the controller-manager's own ClusterRole retains the permissions it needs to grant that Role. - CloudKittyAPI and CloudKittyProc call lib-common's VerifyNetworkStatusFromAnnotation to verify NetworkAttachments, which lists Pods using the controller-manager's own client. Keep the get;list kubebuilder markers on both. Regenerate config/rbac/role.yaml. Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
91a7cb6 to
14250d0
Compare
|
New changes are detected. LGTM label has been removed. |
|
/retest |
|
Build failed (check pipeline). Post ✔️ telemetry-openstack-meta-content-provider-master SUCCESS in 4h 23m 10s |
|
recheck |
cfb8329
into
openstack-k8s-operators:main
|
/cherry-pick 18-stable |
|
@stuggi: new pull request created: #968 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
The workload rbacRules and kubebuilder RBAC markers granted the operator and its workload service account full CRUD (create/delete/get/list/patch/update/ watch) on core Pods, but the operator never reads or writes Pod objects directly — pods only ever come into being indirectly via Deployments/ StatefulSets/Jobs. Remove the unused pods permission and regenerate config/rbac/role.yaml.