help wantedkind/cleanuppriority/important-longtermtriage/accepted
Repository metrics
- Stars
- (4,267 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
Following on from #https://github.com/kubernetes-sigs/cluster-api/pull/6510#discussion_r882538225
In Cluster API today we create RBAC manifests which are generated using kubebuilder tools. e.g.
Many of our controllers seem to generate overly broad RBAC for themselves. e.g. many have the create verb when it is not used. Removing these roles should have no impact on functitonality, minimize the capabilities of our controllers from a security perspective, and make our RBAC manifests more descriptive about what our controllers are actually doing.
We should audit the following controllers to minimize their RBAC roles:
- MachineHealthCheck
- Machinepool
- KubeadmConfig
- ClusterResourceSet
- Cluster
- Machine
- MachineDeployment
- MachineSet
- Topology/Cluster
- ClusterClass