chore: Describe RBAC rules, remove unnecessary rules#916
Open
NickLarsenNZ wants to merge 11 commits intomainfrom
Open
chore: Describe RBAC rules, remove unnecessary rules#916NickLarsenNZ wants to merge 11 commits intomainfrom
NickLarsenNZ wants to merge 11 commits intomainfrom
Conversation
17 tasks
NickLarsenNZ
commented
Apr 2, 2026
Co-authored-by: Nick <10092581+NickLarsenNZ@users.noreply.github.com>
… product clusterrole
…he operator manages the Kubernetes events
…close to each other
…tor.yaml and clusterrole-product.yaml
Member
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of stackabletech/issues#798
Note
This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.
Operator ClusterRole (
{fullname}-clusterrole)Rules removed entirely
nodeslist, watchKubernetesClusterInfoonly usesnodes/proxy: getfor cluster domain detection — no node listing or watching anywhere in the controllerendpointscreate, delete, get, list, patch, update, watchpodscreate, delete, get, list, patch, update, watchupdateverb removed from all rulesSSA (
apply_patch) uses HTTP PATCH, not HTTP PUT.client.update()is never called anywhere in the operator source.watchremoved from resources not watched by the controllerserviceaccountscluster_resources.add()+ orphan cleanup, but not watched via.owns()or.watches()inmain.rsrolebindingsbatch/jobspoddisruptionbudgetslisteners.stackable.tech/listenerswatchwas added when the listener operator was integrated but no.owns(Listener)or.watches(Listener)call existssecretsreduced toget, createThe operator only calls
client.get_opt::<Secret>()(to check existence) andclient.create()(to generate the sensitive-property key and OIDC admin password). Secrets are never tracked bycluster_resources, solist,delete,patch,update, andwatchare all unnecessary.patchremoved fromnificlustersThe operator only calls
apply_patch_status()on NifiCluster objects, which targets the/statussubresource (covered by the separatenificlusters/status: patchrule). The main resource is never patched directly.getremoved fromcustomresourcedefinitionsNot needed for crd maintenance, nor startup condition.
Product ClusterRole (
{name}-clusterrole)Remove the configmaps/secrets/serviceaccounts get rule for the product clusterrole. Anything needed is mounted. Anything needed by a NiFi processor should have an explicit role and binding made by the admin of the cluster.