[FLINK-35310] Replace RBAC verb wildcards with actual verbs

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: kubernetes-operator-1.9.0
• Component/s: Kubernetes Operator
• Labels: pull-request-available

Environment

Running on Kubernetes using the flink-operator version 1.8.0

• Assignee: Tim
• Reporter: Tim
• Created: 08/May/24 14:29
• Updated: 27/May/24 10:40
• Resolved: 27/May/24 10:40

Description

We are deploying the flink operator on a managed Kubernetes cluster which utilizes Kyverno Policy Management and all it's default rules. Not complying to certain rules, leads to a restriction in deploying.

As we are using Helm to build the manifest files (which is super useful) I recognized that in the RBAC template "wildcards" are being used for all verbs ("*").

This violates the following Kyverno ruleset: https://kyverno.io/policies/other/restrict-wildcard-verbs/restrict-wildcard-verbs/

Besides that I think that it would also be cleaner to explicitly list the needed verbs instead of just using the star symbol as a wildcard.

I have already attempted to change this in a fork as a demonstration how it could be changed to be conform. Please take a look and I would greatly appreciate a change in that direction.

Issue Links

• links to: GitHub Pull Request #826