Gokul Kolady has posted comments on this change. ( http://gerrit.cloudera.org:8080/24361 )
Change subject: IMPALA-14979: Add ImpalaCluster CRD and RBAC ...................................................................... Patch Set 27: (2 comments) http://gerrit.cloudera.org:8080/#/c/24361/27/operator/impala-operator/manifests/crd-impalacluster.yaml File operator/impala-operator/manifests/crd-impalacluster.yaml: http://gerrit.cloudera.org:8080/#/c/24361/27/operator/impala-operator/manifests/crd-impalacluster.yaml@44 PS27, Line 44: namespace: We already have metadata.namespace on a namespaced CR. Do we need spec.namespace too? With cluster-admin RBAC, this can become a cross-namespace escalation path if reconciler target namespace is taken from spec.namespace. Could we either remove spec.namespace or enforce it equals metadata.namespace (validation/CEL/reconciler check)? http://gerrit.cloudera.org:8080/#/c/24361/27/operator/impala-operator/manifests/rbac.yaml File operator/impala-operator/manifests/rbac.yaml: http://gerrit.cloudera.org:8080/#/c/24361/27/operator/impala-operator/manifests/rbac.yaml@67 PS27, Line 67: name: cluster-admin Should we avoid default cluster-admin binding in the shipped RBAC and scope to required resources (or gate admin mode behind an explicit opt-in)? Current default is very broad for a baseline manifest. -- To view, visit http://gerrit.cloudera.org:8080/24361 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I0ae5fffe1059a42069fb4abe0d54e29775698cf5 Gerrit-Change-Number: 24361 Gerrit-PatchSet: 27 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Gokul Kolady <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Comment-Date: Tue, 16 Jun 2026 20:27:31 +0000 Gerrit-HasComments: Yes
