search

open-policy-agent / kube-mgmt

Sidecar for managing OPA instances in Kubernetes.
Apache License 2.0
238 stars 106 forks source link

Do not use ClusterRole and ClusterRoleBinding when .Values.mgmt.namespaces list is empty #212

Closed AndreaVida closed 1 year ago

AndreaVida commented 1 year ago

When having opa-kube-mgmt watching ConfigMaps from .Release.Namespace only, Role and RoleBinding should be more than enough to operate; not clear why it also requires to get/list/watch namespaces.

Using ClusterRole and ClusterRoleBinding when not needed is a security concern and do not respect namespaces isolation.