Narrow wildcard RBAC verbs to least-privilege on manager ClusterRole - #2027
Narrow wildcard RBAC verbs to least-privilege on manager ClusterRole#2027abays wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abays The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
OpenStackControlPlane CRD Size Report
Threshold reference
|
config/operator/rbac/role.yaml narrows serviceaccounts and services verbs to get,list,delete / get,list,create,update,delete — dropping watch. But deleteAllOwnedResources in openstack_controller.go:408,413 does typed List() calls (corev1.ServiceAccountList, corev1.ServiceList), which go through the controller-runtime cache and need watch for the informer's reflector. Without it, the manager will hit continuous Forbidden errors on Watch() and relist/backoff loops once that code path runs (triggered by OPENSTACK_RELEASE_VERSION changes). Not a hard break (List still works via periodic relist), but will spam errors for the life of the process, like above. I think we either add the watch back, or switching those two List() calls to unstructured. |
Looks like we might need |
247ac04 to
88c5cf8
Compare
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 4h 53m 17s |
Replace verbs: ["*"] with explicit minimal verb sets on the openstack-operator controller's kubebuilder RBAC markers and regenerated manifests: - admissionregistration.k8s.io webhooks: get/list/watch/create/update/delete/deletecollection - apiextensions.k8s.io: narrow resources from "*" to customresourcedefinitions - core serviceaccounts: get/list/delete (only used for cleanup) - core namespaces: get/create/update - core services: get/list/create/update/delete - Remove configmaps from this controller's markers (unused; other controllers declare their own) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
88c5cf8 to
3532763
Compare
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 55m 37s |
|
recheck |
|
/retest |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 25m 10s |
|
@abays: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
|
recheck |
/test openstack-operator-build-deploy-kuttl-4-20 |
2 participants
Replace verbs:
["*"]with explicit minimal verb sets on the openstack-operator controller's kubebuilder RBAC markers and regenerated manifests:admissionregistration.k8s.iowebhooks:get/list/watch/create/update/delete/deletecollectionapiextensions.k8s.io: narrow resources from"*"tocustomresourcedefinitionscoreserviceaccounts:get/list/delete(only used for cleanup)corenamespaces:get/create/updatecoreservices:get/list/create/update/deleteconfigmapsfrom init operator controller markers (unused; other controllers declare their own)