Debezium operator creates a new role and role binding for custom resource when not required
- Dominant language
- HTML
- Stars
- 6
- Forks
- 8
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 1
Description
## Bug report
**What Debezium connector do you use and what version?**
Postgres connector
---
**What is the connector configuration?**
N/A not an issue with the connector. It has to do with the k8s operator
---
**What is the captured database version and mode of deployment?**
Deployed using debezium operator on a k8s cluster
---
**What behavior do you expect?**
AFAIU, the debezium operator creates the underlying k8s resources when DebeziumServer CR gets registered with the control plane. Some of the underlying resources being created are
1. Deployment
2. Configmap
3. Service account
Unless the application is interacting with the control plane, there is no need for it to have any access to the resources via rbac.
---
**What behavior do you see?**
By default a role and rolebinding is being created to read secrets, read configmaps and update offset within a configmap
In my opinion, this is unnecessary. If a new service account is being created, then that should be secure enough without getting default service account's permission.
---
**Do you see the same behaviour using the latest released Debezium version?**
Tried this on top of `3.6.0.Final` operator code base
---
**Do you have the connector logs, ideally from start till finish?**
N/A
In the file `debezium-operator-core/src/main/java/io/debezium/operator/core/DebeziumServerReconciler.java`
```
@Dependent(name = "role", type = RoleDependent.class),
@Dependent(name = "role-binding", type = RoleBindingDependent.class, dependsOn = { "role" },
reconcilePrecondition = ServiceAccountReady.class),
...
@Dependent(name = "deployment", type = DeploymentDependent.class, dependsOn = { "config", "role-binding" }, ...)
```
---
**How to reproduce the issue using our [tutorial](https://github.com/debezium/debezium-examples/tree/main/tutorial) deployment?**
Create a DebeziumServer using operator
Contributor guide
Assessment
This issue has not been assessed yet.