[
https://issues.apache.org/jira/browse/IMPALA-15049?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104210#comment-18104210
]
ASF subversion and git services commented on IMPALA-15049:
----------------------------------------------------------
Commit 9fe51d5f0cc9e672d866da9de5b1387498430e4d in impala's branch
refs/heads/master from Anubhav Jindal
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=9fe51d5f0 ]
IMPALA-15049: Harden Impala Kubernetes operator RBAC permissions
Replace the operator's cluster-admin binding with least-privilege
ClusterRoles scoped to the CRD control plane and the namespaced resources
required by Helm reconcile.
Grant read-only CRD discovery permissions required by Kopf watches so
reconcile remains event-driven under tightened RBAC.
Remove namespace auto-create from reconcile and drop namespace create/get
permissions, because ImpalaCluster is namespaced and must target an
existing namespace.
Document the tightened RBAC model and optional-component permission notes
for LDAP-related resource kinds in the Kubernetes deployment guide.
Add a Helm --set list-index caveat so sparse extraArgs indices are avoided
and do not render blank arguments in container command lines.
Add unit tests that guard against reintroducing cluster-admin and validate
CR status/finalizer + CRD discovery permissions in the RBAC manifest.
Testing:
- python3 operator/impala-operator/tests/test_main.py
- python3 operator/impala-operator/tests/test_rbac_manifest.py
- python3 -m unittest discover -s operator/impala-operator/tests -p "test_*.py"
- python3 bin/jenkins/critique-gerrit-review.py --dryrun
- docker build -f operator/impala-operator/Dockerfile -t impala-operator:15049 .
- k3d image import impala-operator:15049 -c impala-live
- kubectl apply -k operator/impala-operator/manifests
- kubectl -n impala-operator-system set image deploy/impala-operator
operator=impala-operator:15049
- kubectl apply -n impala-rbac-live -f <ImpalaCluster core config>
- kubectl patch -n impala-rbac-live impalacluster impala-rbac-demo --type merge
-p '{"spec":{"ldapEnabled":true}}'
- kubectl patch -n impala-rbac-live impalacluster impala-rbac-demo --type merge
-p '{"spec":{"kuduEnabled":true,"rangerEnabled":true,"rangerAuthEnabled":true}}'
- kubectl delete -n impala-rbac-live impalacluster impala-rbac-demo --wait=true
(operator uninstalls both Helm releases)
- kubectl apply -n impala-exhaustive-live -f <ImpalaCluster with
ldap+kudu+ranger>
- python3 <LDAP impyla smoke script> (CREATE DATABASE, CREATE KUDU TABLE,
INSERT, SELECT)
Change-Id: Ia3eafc1f4ddcda423227ad5fc361e0bbbd4dad19
Assisted-by: GPT-5.3 (Cursor)
Reviewed-on: http://gerrit.cloudera.org:8080/24419
Reviewed-by: Gokul Kolady <[email protected]>
Reviewed-by: Jason Fehr <[email protected]>
Tested-by: Jason Fehr <[email protected]>
> Harden Impala Kubernetes operator RBAC permissions
> --------------------------------------------------
>
> Key: IMPALA-15049
> URL: https://issues.apache.org/jira/browse/IMPALA-15049
> Project: IMPALA
> Issue Type: Task
> Reporter: Anubhav Jindal
> Assignee: Anubhav Jindal
> Priority: Major
>
> * {*}Background{*}:
> ** Current operator deployment uses broad privileges to simplify bootstrap,
> but this is too permissive for production environments.
> * {*}Proposal{*}:
> ** Replace broad {{cluster-admin}} style access with least-privilege RBAC.
> ** Scope permissions to required API groups/resources used by Helm/operator
> reconcile.
> ** Document any optional permissions needed for optional components.
> * *Test* *Plan*:
> ** Deploy operator with tightened RBAC on a clean cluster.
> ** Reconcile core, LDAP, Kudu, and Ranger-enabled CRs.
> ** Verify create/update/delete workflows and status updates still work.
> * *Risks/Notes*:
> ** Under-scoping can cause partial reconcile failures.
> ** Needs careful audit of all resources created by chart + operator.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
