Skip to content

Commit f771ea4

Browse files
ntkatholentkathole
committed
fix: Remove inert subjectaccessreviews and reorganize RBAC rules
Signed-off-by: ntkathole <nikhilkathole2683@gmail.com>
1 parent 89240fa commit f771ea4

5 files changed

Lines changed: 57 additions & 14 deletions

File tree

‎infra/feast-operator/config/rbac/role.yaml‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,10 +163,35 @@ rules:
163163
- rbac.authorization.k8s.io
164164
resources:
165165
- clusterrolebindings
166+
verbs:
167+
- create
168+
- delete
169+
- get
170+
- list
171+
- update
172+
- apiGroups:
173+
- rbac.authorization.k8s.io
174+
resources:
175+
- clusterroles
176+
verbs:
177+
- create
178+
- apiGroups:
179+
- rbac.authorization.k8s.io
180+
resourceNames:
181+
- feast-discover-namespaces
182+
- feast-oidc-token-review
183+
- feast-token-review-cluster-role
184+
resources:
166185
- clusterroles
186+
verbs:
187+
- delete
188+
- get
189+
- update
190+
- apiGroups:
191+
- rbac.authorization.k8s.io
192+
resources:
167193
- rolebindings
168194
- roles
169-
- subjectaccessreviews
170195
verbs:
171196
- create
172197
- delete

‎infra/feast-operator/dist/install.yaml‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22321,10 +22321,35 @@ rules:
2232122321
- rbac.authorization.k8s.io
2232222322
resources:
2232322323
- clusterrolebindings
22324+
verbs:
22325+
- create
22326+
- delete
22327+
- get
22328+
- list
22329+
- update
22330+
- apiGroups:
22331+
- rbac.authorization.k8s.io
22332+
resources:
2232422333
- clusterroles
22334+
verbs:
22335+
- create
22336+
- apiGroups:
22337+
- rbac.authorization.k8s.io
22338+
resourceNames:
22339+
- feast-discover-namespaces
22340+
- feast-oidc-token-review
22341+
- feast-token-review-cluster-role
22342+
resources:
22343+
- clusterroles
22344+
verbs:
22345+
- delete
22346+
- get
22347+
- update
22348+
- apiGroups:
22349+
- rbac.authorization.k8s.io
22350+
resources:
2232522351
- rolebindings
2232622352
- roles
22327-
- subjectaccessreviews
2232822353
verbs:
2232922354
- create
2233022355
- delete

‎infra/feast-operator/internal/controller/authz/authz.go‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -164,11 +164,6 @@ func (authz *FeastAuthorization) setFeastClusterRole(clusterRole *rbacv1.Cluster
164164
Resources: []string{resourceTokenReviews},
165165
Verbs: []string{verbCreate},
166166
},
167-
{
168-
APIGroups: []string{rbacv1.GroupName},
169-
Resources: []string{"subjectaccessreviews"},
170-
Verbs: []string{verbCreate},
171-
},
172167
{
173168
APIGroups: []string{""},
174169
Resources: []string{"namespaces"},
@@ -250,11 +245,6 @@ func (authz *FeastAuthorization) setFeastRole(role *rbacv1.Role) error {
250245
Resources: []string{resourceTokenReviews},
251246
Verbs: []string{verbCreate},
252247
},
253-
{
254-
APIGroups: []string{rbacv1.GroupName},
255-
Resources: []string{"subjectaccessreviews"},
256-
Verbs: []string{verbCreate},
257-
},
258248
{
259249
APIGroups: []string{""},
260250
Resources: []string{"namespaces"},

‎infra/feast-operator/internal/controller/featurestore_controller.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,10 @@ type FeatureStoreReconciler struct {
6767
// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;create;update;watch;delete
6868
// +kubebuilder:rbac:groups=core,resources=services;configmaps;persistentvolumeclaims,verbs=get;list;create;update;watch;delete;deletecollection
6969
// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;create;update;watch;delete
70-
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings;clusterroles;clusterrolebindings;subjectaccessreviews,verbs=get;list;create;update;watch;delete
70+
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;list;create;update;watch;delete
71+
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;create;update;delete
72+
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=create
73+
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,resourceNames=feast-discover-namespaces;feast-oidc-token-review;feast-token-review-cluster-role,verbs=get;update;delete
7174
// +kubebuilder:rbac:groups=core,resources=secrets;namespaces,verbs=get;list;watch
7275
// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;delete;deletecollection
7376
// +kubebuilder:rbac:groups=core,resources=pods/exec,verbs=create

‎infra/feast-operator/internal/controller/featurestore_controller_kubernetes_auth_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ var _ = Describe("FeatureStore Controller-Kubernetes authorization", func() {
227227
feastRole)
228228
Expect(err).NotTo(HaveOccurred())
229229
Expect(feastRole.Rules).ToNot(BeEmpty())
230-
Expect(feastRole.Rules).To(HaveLen(6))
230+
Expect(feastRole.Rules).To(HaveLen(5))
231231
Expect(feastRole.Rules[0].APIGroups).To(HaveLen(1))
232232
Expect(feastRole.Rules[0].APIGroups[0]).To(Equal(rbacv1.GroupName))
233233
Expect(feastRole.Rules[0].Resources).To(HaveLen(2))

0 commit comments

Comments
 (0)