hashicorp / hashicorp/vault-secrets-operator
Least privilege RBAC for VSO
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 601
- Forks
- 145
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Describe the bug**
I'm trying to setup a least privilege RBAC role for the VSO, and so far I was unable to define one that works. The ClusterRole I'm defining is the one below, which does not seem to work:
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: csi-vso-cluster-role
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["clusterroles", "clusterrolebindings"]
verbs: ["get", "list"]
```
Do you have any guidelines on the least privilege RBAC that VSO requires for a proper setup?
Thank you!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files, tests, or entry points are identified in the issue. Start by reviewing VSO's current RBAC requirements and reproducing the provided ClusterRole setup; done means documenting a least-privilege role that supports a proper VSO installation and works in the reported scenario.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authorization, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100