The opa-bundle-builder-clusterrole is never bound

Affected Stackable version

Any (at least up until and including SDP 26.3)

Affected OpenPolicyAgent version

N/A

Current and expected behavior

Currently, the bundle-builder uses the operator service account, and therefore inherits operator permissions.

It should use it's own service account and be bound to the ClusterRole defined in deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml so it has only the necessary permissions to perform its function.

Possible solution

1. Drop the unused ClusterRole
2. Adjust the operator code so that the bundle-builder ClusterRole is used.

Option 2 is probably better, because it at least shows what is needed by the bundle-builder - and allows for architectural changes (like the bundle builder running outside of the OPA cluster pod if that was ever a possibility).

In either case, the comments in https://github.com/stackabletech/opa-operator/pull/820/changes/5dc06dbca2365f9c2957f74318d8f722e972e0d2 will need to be updated.

Additional context

Originally found here: https://github.com/stackabletech/opa-operator/pull/820#discussion_r3062985546

Environment

No response

Would you like to work on fixing this bug?

maybe

Inizia da deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml, quindi segui la configurazione del service account di bundle-builder nel codice dell’operatore. Conferma che il builder utilizzi il proprio service account e che questo ClusterRole sia associato, quindi aggiorna i commenti correlati di pull request #820. Il lavoro è completato quando il builder non eredita più i permessi del service account dell’operatore.