Replace wildcard RBAC markers with explicit resource lists - #672
Replace wildcard RBAC markers with explicit resource lists#672zhiqiangf wants to merge 2 commits into
Conversation
The operator's manager-role ClusterRole used resources: ['*'] on the core API group and verbs: ['*'] on several resources, granting effectively cluster-admin level access. Replace the kubebuilder RBAC markers with explicit resource and verb lists covering only what the operator actually needs. Changes: - dpuoperatorconfig_controller.go: replace resources=* marker with explicit resources (configmaps, serviceaccounts, services, secrets, pods, nodes, persistentvolumeclaims, persistentvolumes, events); replace verbs=* on mutatingwebhookconfigurations with explicit verbs - dataprocessingunit_controller.go: replace verbs=* with explicit verb lists on pods, secrets, services, persistentvolumeclaims, persistentvolumes - Regenerate config/rbac/role.yaml via controller-gen Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Run make bundle to regenerate the ClusterServiceVersion. This picks up the RBAC wildcard removal from the previous commit and also syncs the DpuNetwork CRD entries that were missing after PR openshift#636. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: zhiqiangf The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@zhiqiangf: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
resources=*andverbs=*in kubebuilder RBAC markers with explicit resource and verb lists to follow least-privilege best practicesmanager-roleClusterRole previously used wildcards that granted broader access than needed; this tightens permissions to only the resources the controllers actually useconfig/rbac/role.yamlviamake manifestsand CSV viamake bundleChanges
dpuoperatorconfig_controller.go: replaceresources=*marker with explicit resources (configmaps, serviceaccounts, services, secrets, pods, nodes, persistentvolumeclaims, persistentvolumes, events); replaceverbs=*on remaining resources with explicit verbsdataprocessingunit_controller.go: replaceverbs=*with explicit verb listsconfig/rbac/role.yaml, bundle CSV, andmanifests/stableCSVNote:
make bundlealso picked up theDpuNetworkCRD entries that were not regenerated after PR #636 — these appear in the CSV diff as a separate commit.Test plan
make manifestsproduces no diff (generated role.yaml matches markers)make bundleproduces no diff (CSV matches role.yaml)oc get clusterrole manager-role -o yamlshows no wildcards after deployment🤖 Generated with Claude Code