Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change operator cluster role to be read only by default #3569

Open
atoulme opened this issue Dec 21, 2024 · 1 comment
Open

Change operator cluster role to be read only by default #3569

atoulme opened this issue Dec 21, 2024 · 1 comment
Labels
enhancement New feature or request needs triage

Comments

@atoulme
Copy link

atoulme commented Dec 21, 2024

Component(s)

auto-instrumentation

Is your feature request related to a problem? Please describe.

The operator cluster role as defined here:
https://github.com/open-telemetry/opentelemetry-helm-charts/blob/main/charts/opentelemetry-operator/templates/clusterrole.yaml
This role gives write access to many objects across all namespaces.

Describe the solution you'd like

This should be kept down to a minimum of privileges:

  • Can it be filtered down to specific namespaces?
  • Can we document why the operator requires the right to, say, delete services?

Describe alternatives you've considered

No response

Additional context

No response

@atoulme atoulme added enhancement New feature or request needs triage labels Dec 21, 2024
@atoulme
Copy link
Author

atoulme commented Dec 28, 2024

I have shown it is possible to reduce rights of the operator greatly with https://github.com/otel-warez/whitegloves-operator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request needs triage
Projects
None yet
Development

No branches or pull requests

1 participant