apache / apache/doris-operator

[Enhancement] prune operator resources and rbac rules

Open
#356 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
138
Forks
72
Avg merge
5d 12h
Merged PRs (30d)
3

Description

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/doris-operator/issues?q=is%3Aissue) and found no similar issues.

### Description

Before deploying the Doris Operator to the Kubernetes cluster, our Kubernetes team determined that for Kubernetes clusters running multiple applications, the resource and permission requirements of the current doris-operator pose certain security risks:

1. `ClusterRole` of the doris-operator has the rule of `ClusterRoleBinding` creation and deletion. It could potentially modify the permissions of current and other `ServiceAccount`s;
2. doris-operator requires webhook resources. It may degrade Kubernetes cluster event-processing efficiency, and could even cause cluster-level failures due to improper event handling in the hook.

### Solution

Are webhooks and updating cluster-role-binding necessary for doris-operator? Can we remove them?

### Are you willing to submit PR?

- [x] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.