postgres-operator icon indicating copy to clipboard operation
postgres-operator copied to clipboard

RBAC is spooooooky

Open bit-herder opened this issue 3 years ago • 1 comments

In general it sure seems like the RBAC here is very wide open. However, it still gave me an error on creation of the servicemonitor that the operator tries to create when it runs.

I think based on how open the RBAC cluster-level permissions are this is fairly un-usable from a security standpoint. I did, however, go ahead and give it permissions to work with the servicemonitor object.

bit-herder avatar Sep 30 '22 19:09 bit-herder

https://github.com/movetokube/postgres-operator/pull/98

                              Jgy__
                            jWW  `""9Wf
                          _#WWW     IW
                         jWWWWW     IW
                 __,yyyyyWWWWW     IWyyyy___
            _jyWWP"^``"`.C"9*,J _.mqD:^^"WWWWWWQg__
          jgW"^.C/"    .C'     I    `D.     'D._"WQg_
        jWP` .C"       C'      I     `D._     `D._ "Qg_
      jQP`  .C    ,d^^b._      I      _.d^^b.   `D._ "Qg
     jQ^  .C"   /`   .+" \     I     / "+.   `\   `D.  XQ
    jQ'  .C'   |`  ."    )    _I    (     ".  |    `D.  4#
    Qf  .C     (   (    /    / /\    \     )  )     `D.  Qg
   jW   C'      \__\_.+'    / /  \    `+._/__/       `D  jQ
   Qf   C         C        /_/    \         D         D   Qk
   Qf   C      _  C        \_\____/         D  _      D   QF
   QL   C      \`+.__     _______     ______.+'/      D   QF
   B&   C.      \   \|    ||     |    ||      /       D   Qf
   jQ   `C.      \   |____|/     |____|/__   /      .D'   jW
    TQ   `C.      \._   `+.__________/___/|_/      .D'   jQ`
     9Q   `C.      C.`+._           |   |/.D'     .D'   jQ'
      "Qg  `C.     `C.   `"+-------'   ' .D'     .D'   pW`
       ^WQy `C.     `C.        I        .D'    _.D' yW"
         ^9Qy_`C.    `C.       I       .D'   _.D jgW"
            `9WQgC.__ `C.      I      .D'  _.Dp@@"`
           ilmk `""9WQQggyyyyyygyyyyyQggQWQH""

bit-herder avatar Sep 30 '22 19:09 bit-herder