The opa-bundle-builder-clusterrole is never bound
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- helm, kubernetes, rust
- Domain
- authorization, infrastructure
Research direction
Start with deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml, then trace the bundle-builder service account setup in the operator code. Confirm that the builder uses its own service account and that this ClusterRole is bound, and update the related comments from pull request #820. Done means the builder no longer inherits the operator service account's permissions.
Written by the indexing model from the issue text.
Description
Affected Stackable version
Any (at least up until and including SDP 26.3)
Affected OpenPolicyAgent version
N/A
Current and expected behavior
Currently, the bundle-builder uses the operator service account, and therefore inherits operator permissions.
It should use it's own service account and be bound to the ClusterRole defined in deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml so it has only the necessary permissions to perform its function.
Possible solution
- Drop the unused ClusterRole
- Adjust the operator code so that the bundle-builder ClusterRole is used.
Option 2 is probably better, because it at least shows what is needed by the bundle-builder - and allows for architectural changes (like the bundle builder running outside of the OPA cluster pod if that was ever a possibility).
In either case, the comments in https://github.com/stackabletech/opa-operator/pull/820/changes/5dc06dbca2365f9c2957f74318d8f722e972e0d2 will need to be updated.
Additional context
Originally found here: https://github.com/stackabletech/opa-operator/pull/820#discussion_r3062985546
Environment
No response
Would you like to work on fixing this bug?
maybe
- Dominant language
- Rust
- Stars
- 21
- Forks
- 5
- Avg merge
- 12h 44m
- Merged PRs (30d)
- 11
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/opa-operator
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
stackabletech/opa-operator#766 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
stackabletech/opa-operator#733 ·
-
Difficulty 2/5 Half a day Newbie friendliness 50/100
stackabletech/opa-operator#724 ·
-
type/bug
Difficulty 5/5 Over a week Newbie friendliness 20/100
stackabletech/opa-operator#718 ·
-
type/bug
Difficulty 3/5 1-2 days Newbie friendliness 35/100
stackabletech/opa-operator#690 ·
All issues in stackabletech/opa-operator
Similar issues
-
todo:perf
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
ACP agents get no MCP servers when the thread is created before the project's first worktree loads Openstate:needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
zed-industries/zed#64611 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
ontola/atomic-server#1625 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
objectionary/phie#154 ·