RBAC limit for istio

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Use case. Why is this important?

During the analysis of RBAC DKP using the ExtensiveRoleCheck utility, the following was discovered:

[!][ClusterRole]→ d8:istio:kiali Has permission to use delete on any resource!

Is kiali supposed to have rights to delete [objects] (https://github.com/deckhouse/deckhouse/blob/main/modules/110-istio/templates/kiali/rbac-for-us.yaml#L101)? There are no such rights in upstream.

[!][ClusterRole]→ d8:istio:operator Has Admin-Cluster permission!
[!][ClusterRole]→ d8:istio:operator Has Admin-Cluster permission!
[!][ClusterRole]→ d8:istio:operator Has Admin-Cluster permission!
[!][ClusterRole]→ d8:istio:operator Has Admin-Cluster permission!
[!][ClusterRole]→ d8:istio:operator Has Admin-Cluster permission!
[!][ClusterRole]→ d8:istio:operator Has permission to access deployments with any verb!
[!][ClusterRole]→ d8:istio:operator Has permission to access roles with any verb!
[!][ClusterRole]→ d8:istio:operator Has permission to list secrets!
[!][ClusterRole]→ d8:istio:operator Has permission to access secrets with any verb!

Are all these rights required for istio operator? They look too wide. In original RBAC there are fewer required rights.

[!][ClusterRole]→ istio-reader-clusterrole-v1x19-d8-istio Has permission to use list on any resource!
[!][ClusterRole]→ istio-reader-clusterrole-v1x19-d8-istio Has permission to list secrets!
[!][ClusterRole]→ istio-reader-d8-istio Has permission to use list on any resource!
[!][ClusterRole]→ istio-reader-d8-istio Has permission to list secrets!
[!][ClusterRole]→ istiod-clusterrole-v1x19-d8-istio Has permission to use list on any resource!
[!][ClusterRole]→ istiod-clusterrole-v1x19-d8-istio Has permission to use list on any resource!
[!][ClusterRole]→ istiod-clusterrole-v1x19-d8-istio Has permission to list secrets!
[!][ClusterRole]→ istiod-d8-istio Has permission to use list on any resource!
[!][ClusterRole]→ istiod-d8-istio Has permission to use list on any resource!
[!][ClusterRole]→ istiod-d8-istio Has permission to list secrets!
[!][ClusterRole]→ istiod-gateway-controller-v1x19-d8-istio Has permission to create deployments!
[!][Role]→ istio:ingress-gateway-controller Has permission to list secrets!
[!][Role]→ istiod-d8-istio Has permission to list secrets!
[!][Role]→ istiod-v1x19 Has permission to list secrets!

Proposed Solution

Grant the minimum required rights to the istio module in the DKP platform.

Additional Information

You might be interested in the audit2rbac tool to minimize permissions for the istio module.