From 7577f6b8593279a61033f57ac03b781d271d844d Mon Sep 17 00:00:00 2001 From: ntkathole Date: Wed, 5 Aug 2026 10:33:16 +0530 Subject: [PATCH] fix: Remove inert subjectaccessreviews and reorganize RBAC rules Signed-off-by: ntkathole --- infra/feast-operator/config/rbac/role.yaml | 27 ++++++++++++++++++- infra/feast-operator/dist/install.yaml | 27 ++++++++++++++++++- .../internal/controller/authz/authz.go | 10 ------- .../controller/featurestore_controller.go | 5 +++- ...restore_controller_kubernetes_auth_test.go | 2 +- 5 files changed, 57 insertions(+), 14 deletions(-) diff --git a/infra/feast-operator/config/rbac/role.yaml b/infra/feast-operator/config/rbac/role.yaml index a79dca283ed..2b17bb5dcc6 100644 --- a/infra/feast-operator/config/rbac/role.yaml +++ b/infra/feast-operator/config/rbac/role.yaml @@ -163,10 +163,35 @@ rules: - rbac.authorization.k8s.io resources: - clusterrolebindings + verbs: + - create + - delete + - get + - list + - update +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - create +- apiGroups: + - rbac.authorization.k8s.io + resourceNames: + - feast-discover-namespaces + - feast-oidc-token-review + - feast-token-review-cluster-role + resources: - clusterroles + verbs: + - delete + - get + - update +- apiGroups: + - rbac.authorization.k8s.io + resources: - rolebindings - roles - - subjectaccessreviews verbs: - create - delete diff --git a/infra/feast-operator/dist/install.yaml b/infra/feast-operator/dist/install.yaml index 3a9f7b6e80e..4ce8b1a1261 100644 --- a/infra/feast-operator/dist/install.yaml +++ b/infra/feast-operator/dist/install.yaml @@ -22321,10 +22321,35 @@ rules: - rbac.authorization.k8s.io resources: - clusterrolebindings + verbs: + - create + - delete + - get + - list + - update +- apiGroups: + - rbac.authorization.k8s.io + resources: - clusterroles + verbs: + - create +- apiGroups: + - rbac.authorization.k8s.io + resourceNames: + - feast-discover-namespaces + - feast-oidc-token-review + - feast-token-review-cluster-role + resources: + - clusterroles + verbs: + - delete + - get + - update +- apiGroups: + - rbac.authorization.k8s.io + resources: - rolebindings - roles - - subjectaccessreviews verbs: - create - delete diff --git a/infra/feast-operator/internal/controller/authz/authz.go b/infra/feast-operator/internal/controller/authz/authz.go index 9ab8d10c55c..d50d6ed25a5 100644 --- a/infra/feast-operator/internal/controller/authz/authz.go +++ b/infra/feast-operator/internal/controller/authz/authz.go @@ -164,11 +164,6 @@ func (authz *FeastAuthorization) setFeastClusterRole(clusterRole *rbacv1.Cluster Resources: []string{resourceTokenReviews}, Verbs: []string{verbCreate}, }, - { - APIGroups: []string{rbacv1.GroupName}, - Resources: []string{"subjectaccessreviews"}, - Verbs: []string{verbCreate}, - }, { APIGroups: []string{""}, Resources: []string{"namespaces"}, @@ -250,11 +245,6 @@ func (authz *FeastAuthorization) setFeastRole(role *rbacv1.Role) error { Resources: []string{resourceTokenReviews}, Verbs: []string{verbCreate}, }, - { - APIGroups: []string{rbacv1.GroupName}, - Resources: []string{"subjectaccessreviews"}, - Verbs: []string{verbCreate}, - }, { APIGroups: []string{""}, Resources: []string{"namespaces"}, diff --git a/infra/feast-operator/internal/controller/featurestore_controller.go b/infra/feast-operator/internal/controller/featurestore_controller.go index b94808c0df5..cd0c232b864 100644 --- a/infra/feast-operator/internal/controller/featurestore_controller.go +++ b/infra/feast-operator/internal/controller/featurestore_controller.go @@ -67,7 +67,10 @@ type FeatureStoreReconciler struct { // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;create;update;watch;delete // +kubebuilder:rbac:groups=core,resources=services;configmaps;persistentvolumeclaims,verbs=get;list;create;update;watch;delete;deletecollection // +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;create;update;watch;delete -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings;clusterroles;clusterrolebindings;subjectaccessreviews,verbs=get;list;create;update;watch;delete +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;list;create;update;watch;delete +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;create;update;delete +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=create +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,resourceNames=feast-discover-namespaces;feast-oidc-token-review;feast-token-review-cluster-role,verbs=get;update;delete // +kubebuilder:rbac:groups=core,resources=secrets;namespaces,verbs=get;list;watch // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;delete;deletecollection // +kubebuilder:rbac:groups=core,resources=pods/exec,verbs=create diff --git a/infra/feast-operator/internal/controller/featurestore_controller_kubernetes_auth_test.go b/infra/feast-operator/internal/controller/featurestore_controller_kubernetes_auth_test.go index 3bfab485e85..3c89bc2d01a 100644 --- a/infra/feast-operator/internal/controller/featurestore_controller_kubernetes_auth_test.go +++ b/infra/feast-operator/internal/controller/featurestore_controller_kubernetes_auth_test.go @@ -227,7 +227,7 @@ var _ = Describe("FeatureStore Controller-Kubernetes authorization", func() { feastRole) Expect(err).NotTo(HaveOccurred()) Expect(feastRole.Rules).ToNot(BeEmpty()) - Expect(feastRole.Rules).To(HaveLen(6)) + Expect(feastRole.Rules).To(HaveLen(5)) Expect(feastRole.Rules[0].APIGroups).To(HaveLen(1)) Expect(feastRole.Rules[0].APIGroups[0]).To(Equal(rbacv1.GroupName)) Expect(feastRole.Rules[0].Resources).To(HaveLen(2))