Privileged ServiceAccounts without rackAwarness enabled

Abierto
  • ¿Algo no está bien?
#851 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
72/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
kubernetes, rust
Área
backend, security

Línea de trabajo

Start with hdfs_clusterrolebinding_nodes_controller.rs, where HdfsCluster ServiceAccounts are added to hdfs-clusterrolebinding-nodes, and review the spec.clusterConfig.rackAwareness checks used around core_site.rs. Update the reflector to watch full HdfsCluster objects with DeserializeGuard so invalid clusters do not block reconciliation. The change is done when only rack-awareness-enabled clusters appear as subjects, while existing bindings and unrelated cluster reconciliation remain correct; run the repository's relevant Rust tests if present.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

type/bug
Affected Stackable version

25.7.0, 25.11.0, 26.3.0 and 26.7.0

Affected Apache HDFS version

all

Current and expected behavior

Current

hdfs-operator maintains a single ClusterRoleBinding hdfs-clusterrolebinding-nodes to the ClusterRole hdfs-clusterrole-nodes, which grants cluster-wide get/list/watch on pods, nodes and endpoints (plus listeners and CRDs). It exists for the rack awareness topology provider.

The operator adds the ServiceAccount of every HdfsCluster as a subject, whether or not rackAwareness is set. The topology provider is only configured when rackAwareness is set (core_site.rs), so clusters without it get these rights without using them.

Expected

A HdfsCluster's ServiceAccount is only a subject of hdfs-clusterrolebinding-nodes when that cluster sets rackAwareness.

Fix

In hdfs_clusterrolebinding_nodes_controller.rs, only add clusters with spec.clusterConfig.rackAwareness set. The reflector currently watches PartialObjectMeta (no spec), so it needs to watch full objects, using DeserializeGuard so one broken HdfsCluster doesn't block the binding for all of them.

Out of scope: the ServiceAccount is shared by all roles, but only the NameNode runs the topology provider.

Possible solution

No response

Additional context

No response

Environment

No response

Would you like to work on fixing this bug?

No response

Lenguaje dominante
Rust
Estrellas
53
Forks
10
Merge medio
21 h 32 min
PR fusionados (30 d)
10

Preparar el entorno

  • Sin Dockerfile ni archivo de Docker Compose
  • Tiene una plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stackabletech/hdfs-operator

Todos los issues de stackabletech/hdfs-operator

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.