-
Story
-
Resolution: Done
-
Critical
-
None
-
3
-
False
-
False
-
No
-
-
-
-
-
-
1.11.0-3
-
No
-
No
-
Yes
-
None
-
-
MODH Sprint 33, MODH Sprint 36, IDH Sprint 1.9, IDH Sprint 1.10, IDH Sprint 1.11
colored textThe addon's CSV in managed-tenants currently grants cluster-wide admin permissions to the rhods-operator: https://gitlab.cee.redhat.com/service/managed-tenants/-/blob/main/addons/rhods/bundles/1.1.1-41/rhods-operator.1.1.1-41.clusterserviceversion.yaml#L40
The rhods-operator should only have the permissions that it (+ its subcomponents) need to avoid stuff like "layered security breaches" or an error in the operator code wreaking havoc in the customer's workloads.
