The opa-bundle-builder-clusterrole is never bound

Affected Stackable version

Any (at least up until and including SDP 26.3)

Affected OpenPolicyAgent version

N/A

Current and expected behavior

Currently, the bundle-builder uses the operator service account, and therefore inherits operator permissions.

It should use it's own service account and be bound to the ClusterRole defined in deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml so it has only the necessary permissions to perform its function.

Possible solution

1. Drop the unused ClusterRole
2. Adjust the operator code so that the bundle-builder ClusterRole is used.

Option 2 is probably better, because it at least shows what is needed by the bundle-builder - and allows for architectural changes (like the bundle builder running outside of the OPA cluster pod if that was ever a possibility).

In either case, the comments in https://github.com/stackabletech/opa-operator/pull/820/changes/5dc06dbca2365f9c2957f74318d8f722e972e0d2 will need to be updated.

Additional context

Originally found here: https://github.com/stackabletech/opa-operator/pull/820#discussion_r3062985546

Environment

No response

Would you like to work on fixing this bug?

maybe

deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml から始め、続いて operator コード内の bundle-builder service account の設定をたどります。builder が独自の service account を使用し、この ClusterRole がバインドされていることを確認し、pull request #820 に関連するコメントを更新します。builder が operator service account の権限を継承しなくなれば完了です。