Give HNC permission to all verbs on all resources

[0xVox]

user "system:serviceaccount:hnc-system:default" (groups=["system:serviceaccounts" "system:serviceaccounts:hnc-system" "system:authenticated"]) is attempting to grant RBAC permissions not currently held

When a sub-namespace is created under a parent namespace containing RoleBindings that are attached to a Role that have permissions such as:

- apiGroups:
  - '*'
  resources:
  - 'persistentvolumeclaims'
  verbs:
  - '*'

The hnc-controller will not have enough permissions to propogate the rolebinding. Note the key problem here is that the hnc-manager-role does not have verbs: '*' permissions itself.

I don't suspect adding this permission is desirable, and this error has given me some roles to review, but I do think it would be desirable to note somewhere in the documentation or installation guide that this might be among the first issues a new user might come across if they've got some quite permissive roles hanging around, created by themselves or through third-party controller installs.

Thank you for your work on this project!

[adrianludwin]

Thanks @0xVox ! We've tried to make the default HNC permissions equivalent to the builtin admin ClusterRole. Do you know if this missing permission would have been part of that role? If so, perhaps we should simply start using the admin role instead of trying to simulate it.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[yiqigao217]

/remove-lifecycle stale
@adrianludwin move this to backlog?

[adrianludwin]

This one seems doable in the next release.

…

On Tue, Mar 16, 2021 at 9:19 AM Yiqi Gao ***@***.***> wrote: /remove-lifecycle stale @adrianludwin <https://github.com/adrianludwin> move this to backlog? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1311 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE43PZDRE44WRHNSDDCYO5DTD5LG7ANCNFSM4UTJ6JAQ> .

[adrianludwin]

@0xVox - it turns out we already do document the permissions (here), but I think it makes sense to just grant HNC permission to all verbs. There's no particular reason to exclude anything.

I verified that once I did this, HNC was able to propagate cluster-admin rolebindings in namespaces, which would probably have solved your problem too. PR forthcoming.

[adrianludwin]

/assign