From 2adbb9411ddecb7af8d55f6992b09923c6065738 Mon Sep 17 00:00:00 2001 From: Martin Schuppert Date: Fri, 24 Jul 2026 15:18:49 +0200 Subject: [PATCH] Remove unnecessary pods RBAC permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workload rbacRules and kubebuilder RBAC markers granted the operator and its workload service account full CRUD (create/delete/get/list/patch/update/ watch) on core Pods, but the operator never reads or writes Pod objects directly — pods only ever come into being indirectly via Deployments/ StatefulSets/Jobs. Remove the unused pods permission and regenerate config/rbac/role.yaml. Signed-off-by: Martin Schuppert --- config/rbac/role.yaml | 1 - internal/controller/keystoneapi_controller.go | 6 ------ 2 files changed, 7 deletions(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 7d76a7c0..716528a8 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -8,7 +8,6 @@ rules: - "" resources: - configmaps - - pods - secrets - services verbs: diff --git a/internal/controller/keystoneapi_controller.go b/internal/controller/keystoneapi_controller.go index 53b638c9..05eaeb2f 100644 --- a/internal/controller/keystoneapi_controller.go +++ b/internal/controller/keystoneapi_controller.go @@ -125,7 +125,6 @@ type KeystoneAPIReconciler struct { // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch // keystone service account permissions that are needed to grant permission to the above // +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use -// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch // Reconcile reconcile keystone API requests func (r *KeystoneAPIReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, _err error) { @@ -549,11 +548,6 @@ func (r *KeystoneAPIReconciler) reconcileInit( Resources: []string{"securitycontextconstraints"}, Verbs: []string{"use"}, }, - { - APIGroups: []string{""}, - Resources: []string{"pods"}, - Verbs: []string{"create", "get", "list", "watch", "update", "patch", "delete"}, - }, } rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules) if err != nil {