Remove unnecessary pods RBAC permissions - #682
Conversation
d6d6ba3 to
cde917b
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 15m 10s |
|
recheck |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 13m 33s |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abays, stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 18m 25s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 18m 12s |
The workload rbacRules in cinder_controller.go granted the workload service account full CRUD (create/delete/get/list/patch/update/watch) on core Pods, but that service account never reads or writes Pod objects directly. Remove the unused rbacRules grant. The kubebuilder RBAC markers for pods are kept (get;list), and restored on CinderAPI, CinderBackup, CinderScheduler and CinderVolume where they were removed: lib-common's VerifyNetworkStatusFromAnnotation, called from those four controllers to verify NetworkAttachments, lists Pods using the controller-manager's own client, so the manager's ClusterRole (config/rbac/role.yaml) still needs get;list on pods. Regenerate config/rbac/role.yaml. Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
cde917b to
ce27c85
Compare
|
New changes are detected. LGTM label has been removed. |
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 15m 20s |
|
recheck |
f40a22c
into
openstack-k8s-operators:main
|
/cherry-pick 18-stable |
|
@stuggi: new pull request created: #689 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
Operators create Deployments/StatefulSets/Jobs to run workload pods but never manage Pod objects directly (get/list/watch/create/update/patch/delete). Drop the unused "pods" resource from the kubebuilder RBAC markers and the workload-facing ClusterRole rbacRules, and regenerate config/rbac/role.yaml accordingly.