[18-stable] Remove unnecessary pods RBAC permissions - #422
Conversation
The workload rbacRules and kubebuilder RBAC markers granted the operator and its workload service account full CRUD (create/delete/get/list/patch/update/ watch) on core Pods, but the operator never reads or writes Pod objects directly — pods only ever come into being indirectly via Deployments/ StatefulSets/Jobs. Remove the unused pods permission and regenerate config/rbac/role.yaml. Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
SeanMooney
left a comment
SeanMooney
left a comment
There was a problem hiding this comment.
i think in nova at least we did manage pods direcly brefily
so this may have also been copy pasta form nova-operator but ya we shoudl not need this
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
7221be7
into
openstack-k8s-operators:18-stable
|
hum i jsut saw openstack-k8s-operators/nova-operator#1165 do we have the same issue here? |
I don't think so as we don't have networkattachments in watcher-operator |
right, watcher is not using the func from lib-common on networkattachment validation which would check on pod status |
|
ah yes that makes sense we do not have any edpm compoent so we dont need to expose watcerh to the isolated networks |
4 participants
This is an automated cherry-pick of #409
/assign stuggi