search

PaloAltoNetworks / prisma-cloud-compute-operator

15 stars 22 forks source link

Defenders fail to deploy with `monitorIstio: true` #12

Closed mjnagel closed 3 years ago

mjnagel commented 3 years ago

Describe the bug

When monitorIstio: true is enabled the defenders fail to deploy.

Expected behavior

All documented options for the defenders should be supported and work out of the box.

Current behavior

When you deploy with monitorIstio: true the defenders fail to create, with the operator spitting out RBAC errors for:

{APIGroups:[""], Resources:["endpoints"], Verbs:["list"]}
{APIGroups:[""], Resources:["pods"], Verbs:["list"]}
{APIGroups:[""], Resources:["pods/proxy"], Verbs:["get"]}
{APIGroups:["networking.istio.io"], Resources:["destinationrules"], Verbs:["list"]}
{APIGroups:["networking.istio.io"], Resources:["gateways"], Verbs:["list"]}
{APIGroups:["networking.istio.io"], Resources:["virtualservices"], Verbs:["list"]}
{APIGroups:["security.istio.io"], Resources:["authorizationpolicies"], Verbs:["list"]}
{APIGroups:["security.istio.io"], Resources:["peerauthentications"], Verbs:["list"]}

Possible solution

Add the above to the role/clusterrole for the operator.

Steps to reproduce

  1. Deploy the operator
  2. Deploy a ConsoleDefender with monitorIstio set to true
  3. Validate that defenders do not get created and there are RBAC issues in the operator logs.

Additional Info

Unsure if any of the other options would cause similar RBAC problems, but might be worth investigating.