Overly permissive ClusterRole permissions
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.6k
- Forks
- 631
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 6
Description
Describe the bug
knative-eventing-controller ClusterRole is overly permissive. For example, why does knative-eventing require the deletion of events or namespaces?
Expected behavior
Reduce permissions to only require what is needed by knative-eventing
To Reproduce
N/A
Knative release version
v1.6.0
Additional context
Add any other context about the problem here such as proposed priority
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with config/core/roles/controller-clusterroles.yaml, especially the linked permissions around lines 26-42. Trace which permissions knative-eventing actually needs and compare them with the current ClusterRole, focusing on the questioned access to events and namespaces. Done means the role retains only required permissions and the configuration remains valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100