Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Done
Priority: Major
Fix Version/s: RHDG Operator CSV 8.3.6 GA
Affects Version/s: None
Component/s: Operator
Labels:
None

Blocked:
False
Blocked Reason:
None
Ready:
False
Target Release:

RHDG Operator CSV 8.3.6 GA
Workaround Description:

Hide

Deploy the Operator separate to application deployments in namespace with more restricted user access using MultiNamespace or AllNamespaces.

Show
Deploy the Operator separate to application deployments in namespace with more restricted user access using MultiNamespace or AllNamespaces .
Git Pull Request:
https://github.com/infinispan/infinispan-operator/pull/1565

SFDC Cases Counter:
SFDC Cases Links:

Description

The Operator currently requests clusterwide permissions to create/delete ServiceAccounts. Consequently, when the Operator is deployed in OwnNamespace mode it's possible for users with admin rights to retrieve the Operator's ServiceAccount token and use this to login granting them the ability to delete arbitrary ServiceAccounts in the k8s cluster which could cause the cluster to become unstable.

https://issues.redhat.com/browse/DGSUP-76

Solution: Only request ServiceAccount permissions at the namespace level.