OLM allows edit cluster role users to create new resource

[xiangjingli]

Bug Report

After installing an operator, one edit cluster role is generated by OLM, where create verb is added. That allows users with the the edit role can create new resources.

What did you do?

1. Install Multicluster Subscription Operator from operator hub in Openshift.
2. check the edit cluster role is generated with the create verb

% oc get clusterrole applications.app.k8s.io-v1beta1-edit -o yaml                          
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: "2020-06-21T04:34:40Z"
  labels:
    olm.opgroup.permissions/aggregate-to-6c3bb1110d0b9f9c-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: applications.app.k8s.io-v1beta1-edit
  ownerReferences:
  - apiVersion: apiextensions.k8s.io/v1beta1
    blockOwnerDeletion: false
    controller: false
    kind: CustomResourceDefinition
    name: applications.app.k8s.io
    uid: 8e2952cd-71fc-4370-8d97-cd9c1f25d017
  resourceVersion: "66882843"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterroles/applications.app.k8s.io-v1beta1-edit
  uid: 0bbc53d5-dd5d-4a73-a1ac-05afe5d3e2ef
rules:
- apiGroups:
  - app.k8s.io
  resources:
  - applications
  verbs:
  - create
  - update
  - patch
  - delete

What did you expect to see?

It seems edit role user should not be allowed to create new resources. On the other hand, we noticed that the create permission is widely applied in all openshift edit roles e.g. system:openshift:aggregate-to-edit

Could someone clarify if it is by Openshift/OLM Design?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jnpacker]

This still seems to be a problem.

[mikeshng]

Hi @joelanford do you have any insight around this area? Thanks.