Skip to content

Commit f413d82

Browse files
fix: Remove inert subjectaccessreviews and reorganize RBAC rules
Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent a9219d9 commit f413d82

2 files changed

Lines changed: 26 additions & 11 deletions

File tree

infra/feast-operator/config/rbac/role.yaml

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,10 +163,35 @@ rules:
163163
- rbac.authorization.k8s.io
164164
resources:
165165
- clusterrolebindings
166+
verbs:
167+
- create
168+
- delete
169+
- get
170+
- list
171+
- update
172+
- apiGroups:
173+
- rbac.authorization.k8s.io
174+
resources:
175+
- clusterroles
176+
verbs:
177+
- create
178+
- apiGroups:
179+
- rbac.authorization.k8s.io
180+
resourceNames:
181+
- feast-discover-namespaces
182+
- feast-oidc-token-review
183+
- feast-token-review-cluster-role
184+
resources:
166185
- clusterroles
186+
verbs:
187+
- delete
188+
- get
189+
- update
190+
- apiGroups:
191+
- rbac.authorization.k8s.io
192+
resources:
167193
- rolebindings
168194
- roles
169-
- subjectaccessreviews
170195
verbs:
171196
- create
172197
- delete

infra/feast-operator/internal/controller/authz/authz.go

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -164,11 +164,6 @@ func (authz *FeastAuthorization) setFeastClusterRole(clusterRole *rbacv1.Cluster
164164
Resources: []string{resourceTokenReviews},
165165
Verbs: []string{verbCreate},
166166
},
167-
{
168-
APIGroups: []string{rbacv1.GroupName},
169-
Resources: []string{"subjectaccessreviews"},
170-
Verbs: []string{verbCreate},
171-
},
172167
{
173168
APIGroups: []string{""},
174169
Resources: []string{"namespaces"},
@@ -250,11 +245,6 @@ func (authz *FeastAuthorization) setFeastRole(role *rbacv1.Role) error {
250245
Resources: []string{resourceTokenReviews},
251246
Verbs: []string{verbCreate},
252247
},
253-
{
254-
APIGroups: []string{rbacv1.GroupName},
255-
Resources: []string{"subjectaccessreviews"},
256-
Verbs: []string{verbCreate},
257-
},
258248
{
259249
APIGroups: []string{""},
260250
Resources: []string{"namespaces"},

0 commit comments

Comments
 (0)