We have noticed instances of Security Misconfiguration in your repository.

Describe the bug
We identified overly permissive Role-Based Access Control (RBAC) rules that grant access to sensitive Kubernetes resources or security-critical operations. Such excessive permissions violate the principle of least privilege and may compromise the confidentiality and integrity of cluster resources.

Unrestricted Secret Access. The RBAC rule allows reading Secrets without restricting access to specific resource names. This may expose sensitive credentials, tokens, API keys, or certificates stored in Secrets. Access should be limited to only the required Secrets by using resourceName and the minimum necessary verbs.

Location:
https://github.com/knative/eventing/blob/5411419863a1ff4b5253e76e358065149deecf8f/config/core/roles/controller-clusterroles.yaml#L25-L41

References: Kubernetes RBAC Good Practices: Listing Secrets, Kubernetes Secrets Good Practices, and MITRE ATT&CK: Unsecured Credentials in Secrets (T1552.007).

CustomResourceDefinition Management. The RBAC rule allows creating, modifying, or deleting CustomResourceDefinitions (CRDs). This permission allows an identity to modify the cluster API schema, potentially introduce malicious custom resources, or disrupt custom controllers and operators that depend on existing CRDs. CRD management should be restricted to trusted cluster administrators and removed when it is not required by the application.

Location:
https://github.com/knative/eventing/blob/5411419863a1ff4b5253e76e358065149deecf8f/config/core/roles/webhook-clusterrole.yaml#L184-L186

Reference: Kubernetes Custom Resources and CustomResourceDefinitions.

Expected behavior
The application should request only the minimum RBAC permissions required for its intended functionality. Permissions that provide access to sensitive information or security-critical operations should be removed, restricted, or limited to the specific resources and operations required by the application.

Knative release version

Additional context
Add any other context about the problem here such as proposed priority

Start by reviewing config/core/roles/controller-clusterroles.yaml at lines 25-41 and config/core/roles/webhook-clusterrole.yaml at lines 184-186. Compare the listed Secret and CustomResourceDefinition permissions with the intended functionality and Kubernetes least-privilege guidance. Done means unnecessary permissions are removed or restricted to the required resources and operations.