dongjoon-hyun opened a new pull request, #744: URL: https://github.com/apache/spark-kubernetes-operator/pull/744
### What changes were proposed in this pull request? This PR aims to replace the wildcard `verbs: ['*']` in the Helm chart RBAC rules (`operator-rbac.yaml` and `workload-rbac.yaml`) with the explicit verb list `get, list, watch, create, update, patch, delete`. ### Why are the changes needed? This addresses CIS Kubernetes Benchmark 5.1.3 (minimize wildcard use in Roles and ClusterRoles). The operator uses informers (`get`/`list`/`watch`), server-side apply (`create`/`patch`), status updates and sentinel replacement (`update`), and resource cleanup (`delete`). Unused verbs such as `deletecollection` are no longer granted. ### Does this PR introduce _any_ user-facing change? Yes. The generated (Cluster)Roles enumerate verbs explicitly instead of `*`; permissions such as `deletecollection` are no longer granted. No operator behavior change is expected. ### How was this patch tested? Pass the CIs. Also manually verified with `helm lint --strict` and `helm template` (default values and all conditional branches). ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Fable 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
