feat(permissions): reduce operator permissions for enhanced security …

[jcantrill]

…posture

Description

This PR:

• removes obsolete operator permissions
• restricts scope to those necessary to meet operator requirements

Links

backport of #3458

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/cluster-logging-operator/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0b53c9ab-97e6-4591-9011-178cf7cac43c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Clee2691]

/lgtm

[vparfonov]

/label verified

Test Setup

Verified the RBAC changes deployed via OLM CSV on an OpenShift cluster. The operator ClusterRole and namespace-scoped Role were inspected to confirm the security fixes match the PR
changes. No ClusterLogForwarder or LokiStack was deployed—verification focused on RBAC configuration and permission boundaries using oc auth can-i tests.

---

Steps Performed

1. Verified operator deployment (CSV cluster-logging.v6.6.0, pod running without errors)
2. Extracted and analyzed ClusterRole RBAC rules
3. Extracted and analyzed namespace-scoped Role for serviceaccount management
4. Checked operator logs for permission-denied errors (none found)
5. Verified wildcard verb removal across all resource types
6. Verified secrets permissions are read-only cluster-wide
7. Verified serviceaccount permissions are namespace-scoped
8. Verified SCC permissions are restricted via resourceNames
9. Verified removed cluster-wide permissions (clusterroles, endpoints, events, prometheusrules)
10. Tested permission boundaries using oc auth can-i for secrets, serviceaccounts, and SCCs
11. Confirmed RBAC permissions are explicit (no wildcards)
12. Confirmed operator functions without permission errors

---

Results

#	Test	Result
1	Wildcard verbs removed from apps resources (daemonsets, deployments)	✅ PASS
2	Secrets scoped to read-only + create cluster-wide (no update/delete)	✅ PASS
3	ServiceAccounts read-only cluster-wide, write permissions namespace-scoped	✅ PASS
4	SCC permissions restricted to resourceNames: [logging-scc]	✅ PASS
5	Removed cluster-wide permissions (clusterroles, endpoints, events, prometheusrules)	✅ PASS
6	RBAC permissions explicit (clusterrolebindings, roles, rolebindings—no wildcards)	✅ PASS
7	Networking.k8s.io permissions explicit (no wildcards)	✅ PASS
8	logging.openshift.io permissions explicit (specific resources, no wildcards)	✅ PASS
9	No permission-denied errors in operator logs	✅ PASS
10	Secrets permission boundaries enforced (list: yes, update/delete: no)	✅ PASS
11	ServiceAccount permission boundaries enforced (namespace create: yes, cluster update: no)	✅ PASS
12	SCC permission boundaries enforced (logging-scc: yes, privileged: no)	✅ PASS

---

Conclusion

✅ Verified. PR #3476 successfully addresses the security concerns in LOG-9753 by eliminating wildcard RBAC permissions and restricting the operator's blast radius:

• Wildcard verbs (*) removed across all resources—replaced with explicit verbs
• Secrets limited to read-only + create cluster-wide (no update/delete/patch)
• ServiceAccount management moved from cluster-wide * to namespace-scoped permissions in openshift-logging, with update restricted to resourceNames: [logfilesmetricexporter]
• SCC permissions restricted to resourceNames: [logging-scc] for get/update/use
• Obsolete cluster-wide permissions removed: clusterroles, endpoints, events, prometheusrules

The exploit scenario described in LOG-9753 (RCE in operator → cluster-admin access via secrets:* + daemonsets:* + scc:*) is mitigated. The operator no longer holds the combination of
permissions that could lead to full cluster compromise. All 12 verification tests passed, and the operator runs without permission errors.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD ff40208 and 2 for PR HEAD f0d7224 in total

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 2f05d8c and 1 for PR HEAD f0d7224 in total

[openshift-ci]

@jcantrill: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/functional-target	f0d7224	link	true	/test functional-target

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.