Skip to content

Duplicate RBAC entries for the namespaces resource #837

@lindhe

Description

@lindhe

Describe the bug
There exists duplicate entries for the namespace resource in the trident-operator ClusterRole:

- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list

- apiGroups:
- ""
resources:
- namespaces
verbs:
- create
- patch

This makes it harder than necessary to review what permissions are granted to the application.

Expected behavior

Instead of having one rule for get and list and one rule for create and patch, I would have expected there to be only one rule for all four verbs:

 - apiGroups: 
     - "" 
   resources: 
     - namespaces 
   verbs:
     - get
     - list
     - create 
     - patch 

Additional context

Note that there are other rules which may seem to also be duplicates, like podsecuritypolicies and securitycontextconstraints. These, however, do actually differ since they have specified resourceNames for each "duplicate" entry!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions