Remove duplicate pod RBAC

[dfarrell07]

The RBAC for pods duplicates the get permission, as it's granted * elsewhere.

This was recently modified in #2225, #2214, and #2008.

Signed-off-by: Daniel Farrell [email protected]

[submariner-bot]

🤖 Created branch: z_pr2336/dfarrell07/gateway_pod_rbac
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

[dfarrell07]

@skitt How did you determine in #2008 that pods didn't need some permissions? Just looking at the code?

@tpantelis How did you spot the error in #2225, as it didn't seem to fail CI?

I ask because I don't know if pods really needs *, or if we can get away with a subset.

[tpantelis]

How did you spot the error in #2225, as it didn't seem to fail CI?

It did fail CI according to the PR summary.

[dfarrell07]

How did you spot the error in #2225, as it didn't seem to fail CI?

It did fail CI according to the PR summary.

Ah okay, I see. I actually linked to the wrong PR there, this is the gateway which was PR #2214. But still, the point is that it should have failed CI on the PR that made the change, not have been merged.

[tpantelis]

Ah okay, I see. I actually linked to the wrong PR there, this is the gateway which was PR #2214. But still, the point is that it should have failed CI on the PR that made the change, not have been merged.

It changed the RBAC yaml and the associated Go file but those are used by subctl so they won't take effect until the Go dependency version for submariner-operator is updated in the subctl repo. This is a side-effect of splitting out the subctl repo.

[dfarrell07]

Ah okay, I see. I actually linked to the wrong PR there, this is the gateway which was PR #2214. But still, the point is that it should have failed CI on the PR that made the change, not have been merged.

It changed the RBAC yaml and the associated Go file but those are used by subctl so they won't take effect until the Go dependency version for submariner-operator is updated in the subctl repo. This is a side-effect of splitting out the subctl repo.

Thanks for clarifying Tom, that makes sense.

[stale]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[skitt]

I would rather move in the other direction: instead of removing explicit permissions which are subsumed by wildcard permissions, remove the wildcard permissions and explicitly list all the permissions we really need (ideally, auto-generated from code comments).

[dfarrell07]

Closing in favor of #1105

[submariner-bot]

🤖 Closed branches: [z_pr2336/dfarrell07/gateway_pod_rbac]