apache / apache/doris-operator
[Enhancement] prune operator resources and rbac rules
- Dominant language
- Go
- Stars
- 138
- Forks
- 72
- Avg merge
- 5d 12h
- Merged PRs (30d)
- 3
Description
### Search before asking
- [x] I had searched in the [issues](https://github.com/apache/doris-operator/issues?q=is%3Aissue) and found no similar issues.
### Description
Before deploying the Doris Operator to the Kubernetes cluster, our Kubernetes team determined that for Kubernetes clusters running multiple applications, the resource and permission requirements of the current doris-operator pose certain security risks:
1. `ClusterRole` of the doris-operator has the rule of `ClusterRoleBinding` creation and deletion. It could potentially modify the permissions of current and other `ServiceAccount`s;
2. doris-operator requires webhook resources. It may degrade Kubernetes cluster event-processing efficiency, and could even cause cluster-level failures due to improper event handling in the hook.
### Solution
Are webhooks and updating cluster-role-binding necessary for doris-operator? Can we remove them?
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.