The opa-bundle-builder-clusterrole is never bound

Affected Stackable version

Any (at least up until and including SDP 26.3)

Affected OpenPolicyAgent version

N/A

Current and expected behavior

Currently, the bundle-builder uses the operator service account, and therefore inherits operator permissions.

It should use it's own service account and be bound to the ClusterRole defined in deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml so it has only the necessary permissions to perform its function.

Possible solution

1. Drop the unused ClusterRole
2. Adjust the operator code so that the bundle-builder ClusterRole is used.

Option 2 is probably better, because it at least shows what is needed by the bundle-builder - and allows for architectural changes (like the bundle builder running outside of the OPA cluster pod if that was ever a possibility).

In either case, the comments in https://github.com/stackabletech/opa-operator/pull/820/changes/5dc06dbca2365f9c2957f74318d8f722e972e0d2 will need to be updated.

Additional context

Originally found here: https://github.com/stackabletech/opa-operator/pull/820#discussion_r3062985546

Environment

No response

Would you like to work on fixing this bug?

maybe

Beginne mit deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml und verfolge anschließend die Einrichtung des bundle-builder service account im Operator-Code. Bestätige, dass der Builder sein eigenes service account verwendet und dass diese ClusterRole gebunden ist, und aktualisiere die zugehörigen Kommentare aus pull request #820. Die Aufgabe ist erledigt, wenn der Builder die Berechtigungen des operator service account nicht mehr erbt.