-
Notifications
You must be signed in to change notification settings - Fork 47
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: Audit template validator RBAC rules. #622
chore: Audit template validator RBAC rules. #622
Conversation
Template validator has and reconciles their owns RBAC rules. It generates the `template:view` ClusterRole for multiple task such as functional testing. In order to be deployed and run functional test the `get` verb is not required on resources `templates` and `virtualmachines`. Signed-off-by: Javier Cano Cano <jcanocan@redhat.com>
Kudos, SonarCloud Quality Gate passed! 0 Bugs No Coverage information |
/retest-required |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/approve
Thanks!
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: 0xFelix The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
@jcanocan @0xFelix , I'd like to know your opinion about RBAC permissions.
When I created rules for the operator, I always added a whole group. I find it strange that we give the operator permission to What do you think? |
Yes, it may be a bit strange. However, I've followed an approach where if something is not required, drop it. My idea was to get a minimal list of verbs. Nevertheless, it does not mean that make sense. So, we can revert all |
No need to revert the change. I just wanted to know your opinion. |
I agree with @jcanocan, we should follow the need to know principle. Even if those verbs are pretty similar. |
Ok, thanks. |
@jcanocan The jira epic is targeted to |
/cherry-pick release-v0.18 |
@akrejcir: new pull request created: #659 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Thanks for taking care of this on my behalf :) |
What this PR does / why we need it:
This PR is a follow-up of #616. For this auditory, we have used the same methodology described in #616. However, due to the fact that these rules are implemented in code, we have not been able to try on Tier 2 test suite.
jira-ticket: https://issues.redhat.com/browse/CNV-30721
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Release note: