Restrict RBAC access - Githubissues

nats-io / nats-streaming-operator

NATS Streaming Operator

Apache License 2.0

174 stars 44 forks source link

Restrict RBAC access #17

Open metalmatze opened 5 years ago

metalmatze commented 5 years ago

I don't think this operator needs all verbs on these Kubernetes objects. We should make sure to have less access.

# Allow actions on basic Kubernetes objects
- apiGroups: [""]
  resources:
  - configmaps
  - secrets
  - pods
  - services
  - serviceaccounts
  - serviceaccounts/token
  - endpoints
  - events
  verbs: ["*"]

amirmasud commented 5 years ago

Any update? It can be so dangerous too. I'd appreciate if you can restrict accesses.