Add RBAC aggregation labels to ObjectStore editor/viewer ClusterRoles

Open Beginner friendly

#1,102 opened on Sep 16, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 1/5
Estimated time: Under an hour
Newbie friendliness: 82/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Active
Tech stack: kubernetes
Domain: authorization

Research direction

Locate the Kubernetes manifest definitions for the barman-plugin-objectstore-editor-role and barman-plugin-objectstore-viewer-role ClusterRoles. Review their metadata alongside the existing CloudNative-PG operator RBAC labels, then verify that the editor role aggregates to admin and edit and the viewer role aggregates to view.

Written by the indexing model from the issue text.

Description

The barman-plugin-objectstore-editor-role and barman-plugin-objectstore-viewer-role ClusterRoles are missing the standard Kubernetes RBAC aggregation labels. Without them, users bound to the built-in admin, edit, or view ClusterRoles can't access ObjectStore resources, even in namespaces where they have full access otherwise.

Any service account that relies on aggregated roles (e.g. an ArgoCD account bound to admin) gets a 403 on ObjectStore CRs:

objectstores.barmancloud.cnpg.io "my-store" is forbidden: User
"system:serviceaccount:my-namespace:my-service-account" cannot get resource "objectstores" in API
group "barmancloud.cnpg.io" in the namespace "my-namespace"

The fix is adding aggregation labels to both ClusterRoles.

On barman-plugin-objectstore-editor-role:

metadata:
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"

On barman-plugin-objectstore-viewer-role:

metadata:
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"

The main CloudNative-PG operator already does this for its CRDs. Without these labels, every deployer has to create RoleBindings for the ObjectStore ClusterRoles manually in each namespace.

Dominant language: Go
Stars: 192
Forks: 75
Avg merge: 1d 7h
Merged PRs (30d): 17

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.