Skip to content

[Enhancement] prune operator resources and rbac rules #356

@xiacongling

Description

@xiacongling

Search before asking

  • I had searched in the issues and found no similar issues.

Description

Before deploying the Doris Operator to the Kubernetes cluster, our Kubernetes team determined that for Kubernetes clusters running multiple applications, the resource and permission requirements of the current doris-operator pose certain security risks:

  1. ClusterRole of the doris-operator has the rule of ClusterRoleBinding creation and deletion. It could potentially modify the permissions of current and other ServiceAccounts;
  2. doris-operator requires webhook resources. It may degrade Kubernetes cluster event-processing efficiency, and could even cause cluster-level failures due to improper event handling in the hook.

Solution

Are webhooks and updating cluster-role-binding necessary for doris-operator? Can we remove them?

Are you willing to submit PR?

  • Yes I am willing to submit a PR!

Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions