fix: restrict CRD verbs to operator-owned resources only#407
Open
mgrzybek wants to merge 5 commits into
Open
Conversation
The operator ClusterRole granted wildcard verbs ["*"] on all
customresourcedefinitions cluster-wide, allowing it to overwrite or
delete CRDs belonging to other operators.
Split the rule in two:
- list, watch on all CRDs (required by kopf for CRD discovery;
resourceNames cannot scope collection operations in Kubernetes RBAC).
- get, create, update, patch restricted via resourceNames to the two
CRDs this operator actually manages:
clusters.caas.azimuth.stackhpc.com
clustertypes.caas.azimuth.stackhpc.com
The helm-unittest snapshot is updated accordingly.
mgrzybek
changed the title
ct lint 3.14.0 requires a maintainers field in Chart.yaml regardless of
validate-maintainers: false (which only skips URL validation). Add a
minimal maintainers entry so lint passes.
Also add check-version-increment: false to ct.yaml — this matches the
intent stated in the existing comment ("skip version bump detection")
which all: true does not actually provide. Reverts the unnecessary 0.1.1
version bump added in the previous commit.
Snapshot regenerated after Chart.yaml change.
ct lint requires a version bump for any changed chart and a maintainers field regardless of validate-maintainers: false (which only skips URL validation). check-version-increment in ct.yaml has no effect when --target-branch is passed on the CLI. - Bump charts/operator version 0.1.0 -> 0.1.1 - Add maintainers field to charts/operator/Chart.yaml - Restore ct.yaml to its original state (check-version-increment has no effect here so the addition is reverted) - Regenerate helm-unittest snapshot
Signed-off-by: Mathieu Grzybek <mathieu@stackhpc.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finding
ClusterRole grants wildcard verbs on
customresourcedefinitionsRoot cause
The operator ClusterRole granted
["*"]on all CRDs cluster-wide. A compromised operator could overwrite or delete CRDs belonging to other operators on the same cluster.Changes
list,watchon all CRDs (required by kopf for CRD discovery —resourceNamescannot scope collection operations in Kubernetes RBAC)get,create,update,patchrestricted viaresourceNamesto the two CRDs this operator actually manages:clusters.caas.azimuth.stackhpc.comandclustertypes.caas.azimuth.stackhpc.comhelm unittest --update-snapshot)