From f0d72246f332fa520ecd52172b64303f29910250 Mon Sep 17 00:00:00 2001 From: Jeff Cantrill Date: Fri, 4 Sep 2026 16:35:29 -0400 Subject: [PATCH] feat(permissions): reduce operator permissions for enhanced security posture --- ...cluster-logging.clusterserviceversion.yaml | 130 ++++++++++++++---- config/rbac/kustomization.yaml | 2 + config/rbac/operator_namespace_role.yaml | 23 ++++ .../rbac/operator_namespace_role_binding.yaml | 14 ++ config/rbac/role.yaml | 109 +++++++++++---- internal/controller/kubebuilder_rbac.go | 26 ++-- 6 files changed, 248 insertions(+), 56 deletions(-) create mode 100644 config/rbac/operator_namespace_role.yaml create mode 100644 config/rbac/operator_namespace_role_binding.yaml diff --git a/bundle/manifests/cluster-logging.clusterserviceversion.yaml b/bundle/manifests/cluster-logging.clusterserviceversion.yaml index 9a952ef73a..3be14161f9 100644 --- a/bundle/manifests/cluster-logging.clusterserviceversion.yaml +++ b/bundle/manifests/cluster-logging.clusterserviceversion.yaml @@ -82,7 +82,7 @@ metadata: categories: OpenShift Optional, Logging & Tracing, Observability certified: "false" containerImage: quay.io/openshift-logging/cluster-logging-operator:latest - createdAt: "2026-07-07T19:26:30Z" + createdAt: "2026-09-11T18:19:14Z" description: The Red Hat OpenShift Logging Operator for OCP provides a means for configuring and managing log collection and forwarding. features.operators.openshift.io/cnf: "false" @@ -2501,7 +2501,12 @@ spec: - daemonsets - deployments verbs: - - '*' + - get + - list + - watch + - create + - update + - delete - apiGroups: - authorization.k8s.io resources: @@ -2530,16 +2535,32 @@ spec: - "" resources: - configmaps - - endpoints - - events - - pods - - secrets + - services + verbs: + - get + - list + - watch + - create + - update + - delete + - apiGroups: + - "" + resources: - serviceaccounts - serviceaccounts/finalizers - - services - - services/finalizers verbs: - - '*' + - get + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create - apiGroups: - "" resources: @@ -2548,54 +2569,89 @@ spec: - get - list - watch + - apiGroups: + - "" + resources: + - pods + - nodes + verbs: + - get + - list + - watch - apiGroups: - logging.openshift.io resources: - - '*' + - logfilemetricexporters verbs: - - '*' + - get + - list + - watch + - apiGroups: + - logging.openshift.io + resources: + - logfilemetricexporters/status + verbs: + - update - apiGroups: - monitoring.coreos.com resources: - - prometheusrules - servicemonitors verbs: - - '*' + - get + - list + - watch + - create + - update - apiGroups: - networking.k8s.io resources: - networkpolicies verbs: - - '*' + - get + - list + - watch + - create + - update + - delete - apiGroups: - observability.openshift.io resources: - clusterlogforwarders verbs: - - '*' + - get + - list + - watch - apiGroups: - observability.openshift.io resources: - - clusterlogforwarders/finalizers + - clusterlogforwarders/status verbs: + - get + - patch - update - apiGroups: - - observability.openshift.io + - rbac.authorization.k8s.io resources: - - clusterlogforwarders/status + - clusterrolebindings verbs: - get - - patch + - list + - watch + - create - update + - delete - apiGroups: - rbac.authorization.k8s.io resources: - - clusterrolebindings - - clusterroles - - rolebindings - roles + - rolebindings verbs: - - '*' + - get + - list + - watch + - create + - update + - delete - apiGroups: - scheduling.k8s.io resources: @@ -2608,9 +2664,16 @@ spec: - securitycontextconstraints verbs: - create + - apiGroups: + - security.openshift.io + resourceNames: + - logging-scc + resources: + - securitycontextconstraints + verbs: - get - - use - update + - use - apiGroups: - hypershift.openshift.io resources: @@ -2689,6 +2752,25 @@ spec: secret: optional: true secretName: cluster-logging-operator-metrics-certs + permissions: + - rules: + - apiGroups: + - "" + resources: + - serviceaccounts + - serviceaccounts/finalizers + verbs: + - create + - apiGroups: + - "" + resourceNames: + - logfilesmetricexporter + resources: + - serviceaccounts + - serviceaccounts/finalizers + verbs: + - update + serviceAccountName: cluster-logging-operator strategy: deployment installModes: - supported: true diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml index b6013ba256..4f2eb508d2 100644 --- a/config/rbac/kustomization.yaml +++ b/config/rbac/kustomization.yaml @@ -1,6 +1,8 @@ resources: - role.yaml - role_binding.yaml +- operator_namespace_role.yaml +- operator_namespace_role_binding.yaml - metadata_reader_clusterrole.yaml - prometheus_role.yaml - prometheus_role_binding.yaml diff --git a/config/rbac/operator_namespace_role.yaml b/config/rbac/operator_namespace_role.yaml new file mode 100644 index 0000000000..b821615fcb --- /dev/null +++ b/config/rbac/operator_namespace_role.yaml @@ -0,0 +1,23 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cluster-logging-operator-serviceaccount-manager + namespace: openshift-logging +rules: +- apiGroups: + - "" + resources: + - serviceaccounts + - serviceaccounts/finalizers + verbs: + - create +- apiGroups: + - "" + resources: + - serviceaccounts + - serviceaccounts/finalizers + resourceNames: + - logfilesmetricexporter + verbs: + - update diff --git a/config/rbac/operator_namespace_role_binding.yaml b/config/rbac/operator_namespace_role_binding.yaml new file mode 100644 index 0000000000..c07f22f9fd --- /dev/null +++ b/config/rbac/operator_namespace_role_binding.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cluster-logging-operator-serviceaccount-manager + namespace: openshift-logging +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cluster-logging-operator-serviceaccount-manager +subjects: +- kind: ServiceAccount + name: cluster-logging-operator + namespace: openshift-logging diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 5269d2b6c0..0a8f905027 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -11,7 +11,12 @@ rules: - daemonsets - deployments verbs: - - '*' + - get + - list + - watch + - create + - update + - delete - apiGroups: - authorization.k8s.io resources: @@ -40,16 +45,32 @@ rules: - "" resources: - configmaps - - endpoints - - events - - pods - - secrets + - services + verbs: + - get + - list + - watch + - create + - update + - delete +- apiGroups: + - "" + resources: - serviceaccounts - serviceaccounts/finalizers - - services - - services/finalizers verbs: - - '*' + - get + - list + - watch +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create - apiGroups: - "" resources: @@ -58,54 +79,89 @@ rules: - get - list - watch +- apiGroups: + - "" + resources: + - pods + - nodes + verbs: + - get + - list + - watch +- apiGroups: + - logging.openshift.io + resources: + - logfilemetricexporters + verbs: + - get + - list + - watch - apiGroups: - logging.openshift.io resources: - - '*' + - logfilemetricexporters/status verbs: - - '*' + - update - apiGroups: - monitoring.coreos.com resources: - - prometheusrules - servicemonitors verbs: - - '*' + - get + - list + - watch + - create + - update - apiGroups: - networking.k8s.io resources: - networkpolicies verbs: - - '*' + - get + - list + - watch + - create + - update + - delete - apiGroups: - observability.openshift.io resources: - clusterlogforwarders verbs: - - '*' + - get + - list + - watch - apiGroups: - observability.openshift.io resources: - - clusterlogforwarders/finalizers + - clusterlogforwarders/status verbs: + - get + - patch - update - apiGroups: - - observability.openshift.io + - rbac.authorization.k8s.io resources: - - clusterlogforwarders/status + - clusterrolebindings verbs: - get - - patch + - list + - watch + - create - update + - delete - apiGroups: - rbac.authorization.k8s.io resources: - - clusterrolebindings - - clusterroles - - rolebindings - roles + - rolebindings verbs: - - '*' + - get + - list + - watch + - create + - update + - delete - apiGroups: - scheduling.k8s.io resources: @@ -118,9 +174,16 @@ rules: - securitycontextconstraints verbs: - create +- apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - logging-scc + verbs: - get - - use - update + - use - apiGroups: - hypershift.openshift.io resources: diff --git a/internal/controller/kubebuilder_rbac.go b/internal/controller/kubebuilder_rbac.go index 917b2e6b3b..7cfe5d83cb 100644 --- a/internal/controller/kubebuilder_rbac.go +++ b/internal/controller/kubebuilder_rbac.go @@ -3,20 +3,28 @@ package controller // This file collects all the "kubebuilder rbac annotations" that the controllers contained // in this operator need to function. -// +kubebuilder:rbac:groups=apps,resources=deployments;daemonsets,verbs=* +// +kubebuilder:rbac:groups=apps,resources=deployments;daemonsets,verbs=get;list;watch;create;update;delete // +kubebuilder:rbac:groups=authorization.k8s.io,resources=subjectaccessreviews,verbs=create // +kubebuilder:rbac:groups=config.openshift.io,resources=proxies;infrastructures,verbs=get;list;watch -// +kubebuilder:rbac:groups=core,resources=pods;services;events;configmaps;secrets;serviceaccounts;serviceaccounts/finalizers;services/finalizers;namespaces,verbs=* +// +kubebuilder:rbac:groups=core,resources=configmaps;services,verbs=get;list;watch;create;update;delete +// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;watch +// +kubebuilder:rbac:groups=core,resources=pods;nodes,verbs=get;list;watch +// +kubebuilder:rbac:groups=core,resources=serviceaccounts;serviceaccounts/finalizers,verbs=get;list;watch +// +kubebuilder:rbac:groups=core,resources=serviceaccounts;serviceaccounts/finalizers,verbs=create,namespace=openshift-logging +// +kubebuilder:rbac:groups=core,resources=serviceaccounts;serviceaccounts/finalizers,verbs=update,resourceNames=logfilesmetricexporter,namespace=openshift-logging +// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create // +kubebuilder:rbac:groups=core,namespaces,verbs=get;list;watch -// +kubebuilder:rbac:groups=logging.openshift.io,resources=*,verbs=* -// +kubebuilder:rbac:groups=monitoring.coreos.com,resources=prometheusrules;servicemonitors,verbs=* -// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=create;delete -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;roles;rolebindings,verbs=* +// +kubebuilder:rbac:groups=logging.openshift.io,resources=logfilemetricexporters,verbs=get;list;watch +// +kubebuilder:rbac:groups=logging.openshift.io,resources=logfilemetricexporters/status,verbs=update +// +kubebuilder:rbac:groups=monitoring.coreos.com,resources=servicemonitors,verbs=get;list;watch;create;update +// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;delete +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;update;delete +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;list;watch;create;update;delete // +kubebuilder:rbac:groups=scheduling.k8s.io,resources=priorityclasses,verbs=delete -// +kubebuilder:rbac:groups=security.openshift.io,resources=securitycontextconstraints,verbs=create;use;get;list;watch +// +kubebuilder:rbac:groups=security.openshift.io,resources=securitycontextconstraints,verbs=create +// +kubebuilder:rbac:groups=security.openshift.io,resources=securitycontextconstraints,resourceNames=logging-scc,verbs=get;update;use // +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get;list;watch -// +kubebuilder:rbac:groups=observability.openshift.io,resources=clusterlogforwarders,verbs=* +// +kubebuilder:rbac:groups=observability.openshift.io,resources=clusterlogforwarders,verbs=get;list;watch // +kubebuilder:rbac:groups=observability.openshift.io,resources=clusterlogforwarders/status,verbs=get;update;patch -// +kubebuilder:rbac:groups=observability.openshift.io,resources=clusterlogforwarders/finalizers,verbs=update