Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove dependency on cluster-admin role #128

Open
nastacio opened this issue Mar 28, 2022 · 1 comment
Open

Remove dependency on cluster-admin role #128

nastacio opened this issue Mar 28, 2022 · 1 comment
Assignees
Labels
chore General upkeep of the repository, not a bug or enhancement

Comments

@nastacio
Copy link
Member

Describe the bug
Many of the Cloud Paks installations have dependencies on having the cluster-admin role assigned to the user performing the installation. This is often unnecessary and a problem for many installations, where security policy require minimum privilege assigned to all roles.

To Reproduce
N/A, stated in the installation section of product documentation:

Expected behavior
Remove the assignment of cluster-admin roles to the ArgoCD openshift-gitops-argocd-application-controller service account and replace it with the creation of new Role (or ClusterRole) with the minimum set of privileges required to install the product.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

@nastacio
Copy link
Member Author

CP4BA and CP4D have since introduced support for this type of installation, where the cluster admin can authorize a service account with narrower privileges, dedicated to the sole purpose of installing the Pak.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
chore General upkeep of the repository, not a bug or enhancement
Projects
None yet
Development

No branches or pull requests

1 participant