fix: restrict permissions to only access specific CRB (#436)

Signed-off-by: Florian Bacher <florian.bacher@dynatrace.com>

config/rbac/role.yaml

@@ -111,10 +111,10 @@ rules:
   - update
 - apiGroups:
   - rbac.authorization.k8s.io
+  resourceNames:
+  - open-feature-operator-flagd-kubernetes-sync
   resources:
   - clusterrolebindings
   verbs:
   - get
-  - list
   - update
-  - watch

main.go

@@ -20,7 +20,9 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	v1 "k8s.io/api/rbac/v1"
 	"os"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
@@ -166,13 +168,16 @@ func main() {
 		os.Exit(1)
 	}
 
+	disableCacheFor := []client.Object{&v1.ClusterRoleBinding{}}
+
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:                 scheme,
 		MetricsBindAddress:     metricsAddr,
 		Port:                   9443,
 		HealthProbeBindAddress: probeAddr,
 		LeaderElection:         enableLeaderElection,
 		LeaderElectionID:       "131bf64c.openfeature.dev",
+		ClientDisableCacheFor:  disableCacheFor,
 	})
 	if err != nil {
 		setupLog.Error(err, "unable to start manager")

webhooks/pod_webhook.go

@@ -51,7 +51,7 @@ const (
 //+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:webhook:path=/mutate-v1-pod,mutating=true,failurePolicy=Ignore,groups="",resources=pods,verbs=create;update,versions=v1,name=mutate.openfeature.dev,admissionReviewVersions=v1,sideEffects=NoneOnDryRun
 //+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;
-//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;update;
+//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;update,resourceNames=open-feature-operator-flagd-kubernetes-sync;
 
 // PodMutator annotates Pods
 type PodMutator struct {