The opa-bundle-builder-clusterrole is never bound

Affected Stackable version

Any (at least up until and including SDP 26.3)

Affected OpenPolicyAgent version

N/A

Current and expected behavior

Currently, the bundle-builder uses the operator service account, and therefore inherits operator permissions.

It should use it's own service account and be bound to the ClusterRole defined in deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml so it has only the necessary permissions to perform its function.

Possible solution

1. Drop the unused ClusterRole
2. Adjust the operator code so that the bundle-builder ClusterRole is used.

Option 2 is probably better, because it at least shows what is needed by the bundle-builder - and allows for architectural changes (like the bundle builder running outside of the OPA cluster pod if that was ever a possibility).

In either case, the comments in https://github.com/stackabletech/opa-operator/pull/820/changes/5dc06dbca2365f9c2957f74318d8f722e972e0d2 will need to be updated.

Additional context

Originally found here: https://github.com/stackabletech/opa-operator/pull/820#discussion_r3062985546

Environment

No response

Would you like to work on fixing this bug?

maybe

Comienza con deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml y luego sigue la configuración de la cuenta de servicio de bundle-builder en el código del operador. Confirma que el builder utiliza su propia cuenta de servicio y que este ClusterRole está vinculado, y actualiza los comentarios relacionados de pull request #820. Se considera terminado cuando el builder ya no hereda los permisos de la cuenta de servicio del operador.