Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable RBAC creation by default #2507

Closed
pavolloffay opened this issue Jan 11, 2024 · 2 comments
Closed

Enable RBAC creation by default #2507

pavolloffay opened this issue Jan 11, 2024 · 2 comments
Labels
enhancement New feature or request needs triage

Comments

@pavolloffay
Copy link
Member

Component(s)

No response

Is your feature request related to a problem? Please describe.

#2394 introduced RBAC capabilities in the operator.
The operator has RBAC to create cluster role and bindings. However the creation of the RBAC for given processors is disabled by default.

Describe the solution you'd like

The proposal is to enable RBAC creation by default. The operator should check with SAR if it can create it (there is already a package for it).

Describe alternatives you've considered

No response

Additional context

No response

@pavolloffay pavolloffay added enhancement New feature or request needs triage labels Jan 11, 2024
@iblancasa
Copy link
Contributor

The proposal is to enable RBAC creation by default. The operator should check with SAR if it can create it (there is already a package for it).

Right now, we are giving permissions to the OpenTelemetry Operator Service Account permissions to create the ClusterRoles and ClusterRoleBindings (as part of the manifest). So, the current package to check if one service account has permission to manage another resource, would return true always for ClusterRoles and ClusterRoleBindings and the operator service account, right? To make this thing work properly, we would need to remove the permissions in the operator service account and document how to add those permissions or something.

@pavolloffay
Copy link
Member Author

This is related to #2588

Closing as the RBAC will be just documented

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request needs triage
Projects
None yet
Development

No branches or pull requests

2 participants