Revert "More fine-grained control over powerful RBAC permission granted via Helm chart" #7836
Conversation
…ed via Helm chart" Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
127b951 to
587f0c2
Compare
There was a problem hiding this comment.
/approve
/lgtm
Yes, I agree. The fix proposed in #7823 does not seem quite right.
For example, the ACME challenges controller not only relies on a Pod informer; it also relies on an ingress informer, unconditionally. So in the same way that the DNS-01 role needs permission to list and watch pods, it would strictly need permission to list and watch Ingress...and if we go down that path, the DNS-01 role would look overly permissive to a casual observer. It happens to work, because the Ingress list and watch permissions are also granted by roles designed for ingress-shim.
Let's try and figure out a better UX for this feature; something like global.disableHTTP01.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: wallrj The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/cherrypick release-1.18 |
|
@inteon: once the present PR merges, I will cherry-pick it on top of In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@inteon: new pull request created: #7837 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This reverts commit 40e446e. It was reverted upstream in cert-manager/cert-manager#7836
Reverts #7666.
As noted in #7598, there is an issue with informers that are failing due to the new RBAC.
We have a proposed fix here: #7823.
I'm reverting the PR to give ourselves a bit more time to finetune this fix and maybe consider disabling these informers instead of adding more RBAC.
The goal is to include the fix in
v1.19.Kind
/kind bug
Release Note