Privileged ServiceAccounts without rackAwarness enabled

Open
  • Is something wrong?
#851 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
kubernetes, rust
Domain
backend, security

Research direction

Start with hdfs_clusterrolebinding_nodes_controller.rs, where HdfsCluster ServiceAccounts are added to hdfs-clusterrolebinding-nodes, and review the spec.clusterConfig.rackAwareness checks used around core_site.rs. Update the reflector to watch full HdfsCluster objects with DeserializeGuard so invalid clusters do not block reconciliation. The change is done when only rack-awareness-enabled clusters appear as subjects, while existing bindings and unrelated cluster reconciliation remain correct; run the repository's relevant Rust tests if present.

Written by the indexing model from the issue text.

Description

type/bug
Affected Stackable version

25.7.0, 25.11.0, 26.3.0 and 26.7.0

Affected Apache HDFS version

all

Current and expected behavior

Current

hdfs-operator maintains a single ClusterRoleBinding hdfs-clusterrolebinding-nodes to the ClusterRole hdfs-clusterrole-nodes, which grants cluster-wide get/list/watch on pods, nodes and endpoints (plus listeners and CRDs). It exists for the rack awareness topology provider.

The operator adds the ServiceAccount of every HdfsCluster as a subject, whether or not rackAwareness is set. The topology provider is only configured when rackAwareness is set (core_site.rs), so clusters without it get these rights without using them.

Expected

A HdfsCluster's ServiceAccount is only a subject of hdfs-clusterrolebinding-nodes when that cluster sets rackAwareness.

Fix

In hdfs_clusterrolebinding_nodes_controller.rs, only add clusters with spec.clusterConfig.rackAwareness set. The reflector currently watches PartialObjectMeta (no spec), so it needs to watch full objects, using DeserializeGuard so one broken HdfsCluster doesn't block the binding for all of them.

Out of scope: the ServiceAccount is shared by all roles, but only the NameNode runs the topology provider.

Possible solution

No response

Additional context

No response

Environment

No response

Would you like to work on fixing this bug?

No response

Dominant language
Rust
Stars
53
Forks
10
Avg merge
1d 5h
Merged PRs (30d)
12

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stackabletech/hdfs-operator

All issues in stackabletech/hdfs-operator

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.