redhat-cop / redhat-cop/group-sync-operator
Secret permissions too wide ?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 132
- Forks
- 71
- PR merge metrics
- No merged PRs in 30d
Description
It seems the operator has "get, watch, list" on the secrets of all namespaces. I assume that it's because it's possible to use secrets from any namespace. But is that necessary ? Wouldn't be wiser to allow only to read secrets from its own namespace ?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the operator's RBAC rules for secrets and tracing how secret access is used across namespaces. Determine the minimum required scope and verify that narrowing permissions does not break group synchronization; the work is done when the manifest reflects the justified scope and relevant checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authorization, devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100