The opa-bundle-builder-clusterrole is never bound
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 52/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- helm, kubernetes, rust
调研方向
从 deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml 开始，然后跟踪 operator 代码中 bundle-builder service account 的配置。确认 builder 使用其自己的 service account，并确认此 ClusterRole 已绑定，然后更新 pull request #820 中相关的注释。完成的标准是 builder 不再继承 operator service account 的权限。
由索引模型根据 Issue 内容生成。
描述
Affected Stackable version
Any (at least up until and including SDP 26.3)
Affected OpenPolicyAgent version
N/A
Current and expected behavior
Currently, the bundle-builder uses the operator service account, and therefore inherits operator permissions.
It should use it's own service account and be bound to the ClusterRole defined in deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml so it has only the necessary permissions to perform its function.
Possible solution
- Drop the unused ClusterRole
- Adjust the operator code so that the bundle-builder ClusterRole is used.
Option 2 is probably better, because it at least shows what is needed by the bundle-builder - and allows for architectural changes (like the bundle builder running outside of the OPA cluster pod if that was ever a possibility).
In either case, the comments in https://github.com/stackabletech/opa-operator/pull/820/changes/5dc06dbca2365f9c2957f74318d8f722e972e0d2 will need to be updated.
Additional context
Originally found here: https://github.com/stackabletech/opa-operator/pull/820#discussion_r3062985546
Environment
No response
Would you like to work on fixing this bug?
maybe
- 主要语言
- Rust
- 星标
- 21
- 派生
- 5
- 平均合并
- 12 小时 44 分钟
- 30 天内合并 PR
- 11
贡献指南
这个仓库没有索引到贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
stackabletech/opa-operator 的其他 Issue
-
难度 5/5 一周以上 新手友好度 30/100
stackabletech/opa-operator#766 ·
-
难度 4/5 3-5 天 新手友好度 35/100
stackabletech/opa-operator#733 ·
-
难度 2/5 半天 新手友好度 50/100
stackabletech/opa-operator#724 ·
-
type/bug
难度 5/5 一周以上 新手友好度 20/100
stackabletech/opa-operator#718 ·
-
type/bug
难度 3/5 1-2 天 新手友好度 35/100
stackabletech/opa-operator#690 ·
查看 stackabletech/opa-operator 的全部 Issue
相似的 Issue
-
risk:low runtime status:in-progress type:test
难度 1/5 1 小时以内 新手友好度 92/100
zeroclaw-labs/zeroclaw#11023 ·
-
good first issue refactor
难度 2/5 1-3 小时 新手友好度 72/100
-
难度 2/5 1-3 小时 新手友好度 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
难度 2/5 1-3 小时 新手友好度 84/100
-
难度 1/5 1 小时以内 新手友好度 72/100
bevyengine/bevy#25861 ·