Gokul Kolady has posted comments on this change. ( http://gerrit.cloudera.org:8080/24419 )
Change subject: IMPALA-15049: Harden Impala Kubernetes operator RBAC permissions ...................................................................... Patch Set 26: (1 comment) http://gerrit.cloudera.org:8080/#/c/24419/26/operator/impala-operator/manifests/rbac.yaml File operator/impala-operator/manifests/rbac.yaml: http://gerrit.cloudera.org:8080/#/c/24419/26/operator/impala-operator/manifests/rbac.yaml@45 PS26, Line 45: verbs: ["get", "create"] Since ImpalaCluster is namespaced, metadata.namespace must already exist before the CR is created. With target_ns = namespace in reconcile, the namespace auto-create path is effectively redundant. Could we drop create on namespaces (and remove _ensure_namespace()), to keep RBAC strictly least-privilege and avoid the extra namespace read/create check each reconcile? -- To view, visit http://gerrit.cloudera.org:8080/24419 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia3eafc1f4ddcda423227ad5fc361e0bbbd4dad19 Gerrit-Change-Number: 24419 Gerrit-PatchSet: 26 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Gokul Kolady <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Comment-Date: Wed, 29 Jul 2026 21:15:44 +0000 Gerrit-HasComments: Yes
