You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@flink.apache.org by "Tim (Jira)" <ji...@apache.org> on 2024/05/08 14:30:00 UTC

[jira] [Created] (FLINK-35310) Replace RBAC verb wildcards with actual verbs

Tim created FLINK-35310:
---------------------------

             Summary: Replace RBAC verb wildcards with actual verbs
                 Key: FLINK-35310
                 URL: https://issues.apache.org/jira/browse/FLINK-35310
             Project: Flink
          Issue Type: Improvement
          Components: Kubernetes Operator
         Environment: Running on Kubernetes using the flink-operator version 1.8.0
            Reporter: Tim


We are deploying the flink operator on a managed Kubernetes cluster which utilizes [Kyverno Policy Management|https://kyverno.io/] and all it's default rules. Not complying to certain rules, leads to a restriction in deploying.

As we are using Helm to build the manifest files (which is super useful) I recognized that in the RBAC template "wildcards" are being used for all verbs ("*").

This violates the following Kyverno ruleset: [https://kyverno.io/policies/other/restrict-wildcard-verbs/restrict-wildcard-verbs/]

Besides that I think that it would also be cleaner to explicitly list the needed verbs instead of just using the star symbol as a wildcard.

I have already attempted to change this in a fork as a demonstration how it could be changed to be conform. Please take a look and I would greatly appreciate a change in that direction.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)