Skip to content

Commit c672fbb

Browse files
committed
chore: Remove the configmaps/secrets/serviceaccounts get rule for the product clusterrole
1 parent 30f1b19 commit c672fbb

1 file changed

Lines changed: 0 additions & 12 deletions

File tree

  • deploy/helm/opensearch-operator/templates

deploy/helm/opensearch-operator/templates/roles.yaml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -150,18 +150,6 @@ metadata:
150150
labels:
151151
{{- include "operator.labels" . | nindent 4 }}
152152
rules:
153-
# OpenSearch pods need read access to their own namespace resources at runtime:
154-
# - configmaps: read configuration (e.g. opensearch.yml, log4j2.properties)
155-
# - secrets: read TLS certificates and credentials mounted into the pod
156-
# - serviceaccounts: read own ServiceAccount metadata (e.g. for token projection)
157-
- apiGroups:
158-
- ""
159-
resources:
160-
- configmaps
161-
- secrets
162-
- serviceaccounts
163-
verbs:
164-
- get
165153
# OpenSearch pods emit Kubernetes Events (e.g. via the Stackable logging framework).
166154
- apiGroups:
167155
- events.k8s.io

0 commit comments

Comments
 (0)