Re: [PR] [FLINK-35937] RBAC cleanup [flink-kubernetes-operator]

["mateczagany (via GitHub)" <gi...@apache.org>]

mateczagany commented on code in PR #857:
URL: https://github.com/apache/flink-kubernetes-operator/pull/857#discussion_r1699511520


##########
helm/flink-kubernetes-operator/templates/rbac.yaml:
##########
@@ -61,26 +59,20 @@ rules:
       - update
       - patch
       - delete
+      - deletecollection
   - apiGroups:
-      - extensions
+      - apps
     resources:
-      - deployments
-      - ingresses

Review Comment:
   If we wish to drop support for extensions/v1beta1 API version of Ingress, I think we can also remove the code in `IngressUtils.java:266`. This will make the operator unable to create new Ingress resources for Kubernetes 1.19, but that version has been deprecated for a long time.



##########
helm/flink-kubernetes-operator/templates/rbac.yaml:
##########
@@ -61,26 +59,20 @@ rules:
       - update
       - patch
       - delete
+      - deletecollection
   - apiGroups:
-      - extensions
+      - apps
     resources:
-      - deployments
-      - ingresses
+      - deployments/scale
     verbs:
       - get
-      - list
-      - watch
-      - create
       - update
       - patch
-      - delete
   - apiGroups:
       - flink.apache.org
     resources:
       - flinkdeployments
-      - flinkdeployments/finalizers

Review Comment:
   Won't removing finalizers here affect the fix provided in https://github.com/apache/flink-kubernetes-operator/pull/600/? The finalizers were added here specifically for OpenShift, I think it's related to the `OwnerReferencesPermissionEnforcement` admission plugin. 



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org