From ee8b36c853046d2c182858f37d25e3310b605b01 Mon Sep 17 00:00:00 2001 From: Zhiqiang Fang Date: Thu, 6 Aug 2026 13:36:16 -0400 Subject: [PATCH 1/2] FIND-003: Replace wildcard RBAC with explicit resource list The operator's manager-role ClusterRole used resources: ['*'] on the core API group and verbs: ['*'] on several resources, granting effectively cluster-admin level access. Replace the kubebuilder RBAC markers with explicit resource and verb lists covering only what the operator actually needs. Changes: - dpuoperatorconfig_controller.go: replace resources=* marker with explicit resources (configmaps, serviceaccounts, services, secrets, pods, nodes, persistentvolumeclaims, persistentvolumes, events); replace verbs=* on mutatingwebhookconfigurations with explicit verbs - dataprocessingunit_controller.go: replace verbs=* with explicit verb lists on pods, secrets, services, persistentvolumeclaims, persistentvolumes - Regenerate config/rbac/role.yaml via controller-gen Co-Authored-By: Claude Opus 4.6 --- config/rbac/role.yaml | 33 ++++++++++++++----- .../dataprocessingunit_controller.go | 10 +++--- .../dpuoperatorconfig_controller.go | 16 +++++---- 3 files changed, 39 insertions(+), 20 deletions(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index ab4a2d83c..d83674b0c 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -7,9 +7,13 @@ rules: - apiGroups: - "" resources: - - '*' - configmaps + - persistentvolumeclaims + - persistentvolumes + - pods + - secrets - serviceaccounts + - services verbs: - create - delete @@ -21,19 +25,32 @@ rules: - apiGroups: - "" resources: - - persistentvolumeclaims - - persistentvolumes - - pods - - secrets - - services + - events + verbs: + - create + - patch +- apiGroups: + - "" + resources: + - nodes verbs: - - '*' + - get + - list + - patch + - update + - watch - apiGroups: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations verbs: - - '*' + - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - apiextensions.k8s.io resources: diff --git a/internal/controller/dataprocessingunit_controller.go b/internal/controller/dataprocessingunit_controller.go index efabd7425..b8876e738 100644 --- a/internal/controller/dataprocessingunit_controller.go +++ b/internal/controller/dataprocessingunit_controller.go @@ -66,12 +66,12 @@ func (r *DataProcessingUnitReconciler) WithImagePullPolicy(policy string) *DataP return r } -// +kubebuilder:rbac:groups="",resources=pods,verbs=* +// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups="",resources=secrets,verbs=* -// +kubebuilder:rbac:groups="",resources=services,verbs=* -// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=* -// +kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=* +// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete +// +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch;delete +// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;watch;create;update;patch;delete +// +kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=apps,resources=replicasets,verbs=get;list;watch;create;update;patch;delete diff --git a/internal/controller/dpuoperatorconfig_controller.go b/internal/controller/dpuoperatorconfig_controller.go index b3d3ebcc0..2778f3bbe 100644 --- a/internal/controller/dpuoperatorconfig_controller.go +++ b/internal/controller/dpuoperatorconfig_controller.go @@ -81,14 +81,16 @@ func (r *DpuOperatorConfigReconciler) WithImagePullPolicy(policy string) *DpuOpe //+kubebuilder:rbac:groups=config.openshift.io,resources=servicefunctionchains,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups=config.openshift.io,resources=servicefunctionchains/status,verbs=get;update;patch //+kubebuilder:rbac:groups=config.openshift.io,resources=servicefunctionchains/finalizers,verbs=create;delete;get;list;patch;update;watch -//+kubebuilder:rbac:groups="",resources=*,verbs=get;list;watch;create;update;patch;delete -//+kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=* -//+kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=* -//+kubebuilder:rbac:groups="",resources=pods,verbs=* -//+kubebuilder:rbac:groups="",resources=secrets,verbs=* +//+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete -//+kubebuilder:rbac:groups="",resources=services,verbs=* -//+kubebuilder:rbac:groups=admissionregistration.k8s.io,resources=mutatingwebhookconfigurations,verbs=* +//+kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="",resources=nodes,verbs=get;list;watch;update;patch +//+kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="",resources=events,verbs=create;patch +//+kubebuilder:rbac:groups=admissionregistration.k8s.io,resources=mutatingwebhookconfigurations,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch //+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete From dc0704606318387e454697a1e8f919c613f7dfe8 Mon Sep 17 00:00:00 2001 From: Zhiqiang Fang Date: Thu, 6 Aug 2026 13:36:31 -0400 Subject: [PATCH 2/2] Regenerate bundle CSV to sync with updated RBAC and CRDs Run make bundle to regenerate the ClusterServiceVersion. This picks up the RBAC wildcard removal from the previous commit and also syncs the DpuNetwork CRD entries that were missing after PR #636. Co-Authored-By: Claude Opus 4.6 --- .../dpu-operator.clusterserviceversion.yaml | 42 +++++++++++++++---- .../dpu-operator.clusterserviceversion.yaml | 42 +++++++++++++++---- 2 files changed, 66 insertions(+), 18 deletions(-) diff --git a/bundle/manifests/dpu-operator.clusterserviceversion.yaml b/bundle/manifests/dpu-operator.clusterserviceversion.yaml index be34fd9bf..6b3340ee0 100644 --- a/bundle/manifests/dpu-operator.clusterserviceversion.yaml +++ b/bundle/manifests/dpu-operator.clusterserviceversion.yaml @@ -72,7 +72,7 @@ metadata: } ] capabilities: Basic Install - createdAt: "2025-12-17T09:38:34Z" + createdAt: "2026-08-06T17:22:37Z" features.operators.openshift.io/cnf: "false" features.operators.openshift.io/cni: "true" features.operators.openshift.io/csi: "false" @@ -103,6 +103,9 @@ spec: kind: DataProcessingUnit name: dataprocessingunits.config.openshift.io version: v1 + - kind: DpuNetwork + name: dpunetworks.config.openshift.io + version: v1 - description: DpuOperatorConfig is the Schema for the dpuoperatorconfigs API displayName: Dpu Operator Config kind: DpuOperatorConfig @@ -127,8 +130,13 @@ spec: - apiGroups: - "" resources: - - '*' + - configmaps + - persistentvolumeclaims + - persistentvolumes + - pods + - secrets - serviceaccounts + - services verbs: - create - delete @@ -140,19 +148,32 @@ spec: - apiGroups: - "" resources: - - persistentvolumeclaims - - persistentvolumes - - pods - - secrets - - services + - events verbs: - - '*' + - create + - patch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - patch + - update + - watch - apiGroups: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations verbs: - - '*' + - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - apiextensions.k8s.io resources: @@ -180,6 +201,7 @@ spec: resources: - dataprocessingunitconfigs - dataprocessingunits + - dpunetworks - dpuoperatorconfigs - servicefunctionchains - servicefunctionchains/finalizers @@ -196,6 +218,7 @@ spec: resources: - dataprocessingunitconfigs/finalizers - dataprocessingunits/finalizers + - dpunetworks/finalizers - dpuoperatorconfigs/finalizers verbs: - update @@ -204,6 +227,7 @@ spec: resources: - dataprocessingunitconfigs/status - dataprocessingunits/status + - dpunetworks/status - dpuoperatorconfigs/status - servicefunctionchains/status verbs: diff --git a/manifests/stable/dpu-operator.clusterserviceversion.yaml b/manifests/stable/dpu-operator.clusterserviceversion.yaml index be34fd9bf..6b3340ee0 100644 --- a/manifests/stable/dpu-operator.clusterserviceversion.yaml +++ b/manifests/stable/dpu-operator.clusterserviceversion.yaml @@ -72,7 +72,7 @@ metadata: } ] capabilities: Basic Install - createdAt: "2025-12-17T09:38:34Z" + createdAt: "2026-08-06T17:22:37Z" features.operators.openshift.io/cnf: "false" features.operators.openshift.io/cni: "true" features.operators.openshift.io/csi: "false" @@ -103,6 +103,9 @@ spec: kind: DataProcessingUnit name: dataprocessingunits.config.openshift.io version: v1 + - kind: DpuNetwork + name: dpunetworks.config.openshift.io + version: v1 - description: DpuOperatorConfig is the Schema for the dpuoperatorconfigs API displayName: Dpu Operator Config kind: DpuOperatorConfig @@ -127,8 +130,13 @@ spec: - apiGroups: - "" resources: - - '*' + - configmaps + - persistentvolumeclaims + - persistentvolumes + - pods + - secrets - serviceaccounts + - services verbs: - create - delete @@ -140,19 +148,32 @@ spec: - apiGroups: - "" resources: - - persistentvolumeclaims - - persistentvolumes - - pods - - secrets - - services + - events verbs: - - '*' + - create + - patch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - patch + - update + - watch - apiGroups: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations verbs: - - '*' + - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - apiextensions.k8s.io resources: @@ -180,6 +201,7 @@ spec: resources: - dataprocessingunitconfigs - dataprocessingunits + - dpunetworks - dpuoperatorconfigs - servicefunctionchains - servicefunctionchains/finalizers @@ -196,6 +218,7 @@ spec: resources: - dataprocessingunitconfigs/finalizers - dataprocessingunits/finalizers + - dpunetworks/finalizers - dpuoperatorconfigs/finalizers verbs: - update @@ -204,6 +227,7 @@ spec: resources: - dataprocessingunitconfigs/status - dataprocessingunits/status + - dpunetworks/status - dpuoperatorconfigs/status - servicefunctionchains/status verbs: