🐛 Replace cluster-admin with least-privilege RBAC for BoxcutterRuntime#2514
Conversation
The operator-controller service account was bound to the cluster-admin ClusterRole when the BoxcutterRuntime feature gate was enabled. Replace this with explicit, scoped RBAC rules in the operator-controller-manager-role ClusterRole: - list+watch on all API groups and resources (*/*), required for the boxcutter runtime to set up informers for arbitrary resource types defined in ClusterExtensionRevision phases - Full CRUD (create, get, list, patch, update, watch) on clusterextensionrevisions - patch+update on clusterextensionrevisions/status - update on clusterextensionrevisions/finalizers The ClusterRoleBinding now always references operator-controller-manager-role regardless of whether BoxcutterRuntime is enabled, removing the conditional cluster-admin binding. Static manifests (experimental.yaml and experimental-e2e.yaml) are updated to match. Signed-off-by: Per G. da Silva <pegoncal@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
✅ Deploy Preview for olmv1 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR replaces the cluster-admin ClusterRole binding with least-privilege RBAC permissions for the operator-controller when the BoxcutterRuntime feature gate is enabled, improving security by limiting permissions to only what is necessary.
Changes:
- Added explicit RBAC rules for list/watch on all resources, full CRUD on clusterextensionrevisions, and update permissions on status/finalizers subresources
- Removed conditional cluster-admin binding in favor of always using operator-controller-manager-role
- Updated static manifests (experimental.yaml and experimental-e2e.yaml) to reflect the new RBAC configuration
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| manifests/experimental.yaml | Added new RBAC rules and changed ClusterRoleBinding from cluster-admin to operator-controller-manager-role |
| manifests/experimental-e2e.yaml | Applied same RBAC changes as experimental.yaml for e2e testing environment |
| helm/olmv1/templates/rbac/clusterrolebinding-operator-controller-manager-rolebinding.yml | Removed conditional logic that bound cluster-admin when BoxcutterRuntime was enabled |
| helm/olmv1/templates/rbac/clusterrole-operator-controller-manager-role.yml | Added BoxcutterRuntime-specific RBAC rules when feature gate is enabled |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2514 +/- ##
==========================================
- Coverage 73.21% 73.15% -0.06%
==========================================
Files 102 102
Lines 8505 8505
==========================================
- Hits 6227 6222 -5
- Misses 1802 1805 +3
- Partials 476 478 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
camilamacedo86
changed the title
openshift-ci
bot
added
lgtm
|
/lgtm cancel for another person be able to do that |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: camilamacedo86, rashmigottipati The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/override upgrade-ex2ex-e2e |
|
@grokspawn: Overrode contexts on behalf of grokspawn: upgrade-ex2ex-e2e DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/override project |
|
@grokspawn: /override requires failed status contexts, check run or a prowjob name to operate on.
Only the following failed contexts/checkruns were expected:
If you are trying to override a checkrun that has a space in it, you must put a double quote on the context. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/override codecov/project |
|
@grokspawn: Overrode contexts on behalf of grokspawn: codecov/project DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Note the failure is in the upgrade experimental-to-experimental... This should be ok, as it shouldn't impact existing installs. |
openshift-merge-bot
bot
merged commit fb28936
into
operator-framework:main
5 participants
The operator-controller service account was bound to the cluster-admin ClusterRole when the BoxcutterRuntime feature gate was enabled. Replace this with explicit, scoped RBAC rules in the operator-controller-manager-role ClusterRole:
The ClusterRoleBinding now always references operator-controller-manager-role regardless of whether BoxcutterRuntime is enabled, removing the conditional cluster-admin binding. Static manifests (experimental.yaml and experimental-e2e.yaml) are updated to match.
Description
Reviewer Checklist