operator-framework / operator-framework/operator-sdk
Rules of ClusterRoles with AggregationRule are not included in generated bundle permissions
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 7.7k
- Forks
- 1.8k
- PR merge metrics
- No merged PRs in 30d
Description
ClusterRoles that utilize AggregationRule are often defined without any direct rules. Instead, their permissions are aggregated from other ClusterRoles that match the specified label selector.
However, the current permission generator logic only includes rules from ClusterRoles that are explicitly bound to ServiceAccounts via ClusterRoleBinding. As a result, ClusterRoles using AggregationRule are ignored, leading to incomplete or empty permission bundles.
Impact:
Deployments relying on aggregated ClusterRoles may not receive the required permissions, requring a lot of manual work to copy and paste required permissions from number of ClusterRoles.
Expected Behavior:
The generator should recognize and correctly include rules from ClusterRoles using AggregationRule, by resolving and aggregating the matching ClusterRoles.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named in the issue. Start by locating the permission generator logic that processes ClusterRoleBindings and inspect how ClusterRoles with AggregationRule are handled. Done means matching ClusterRoles are resolved and their rules appear in generated permission bundles for deployments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100