Create a MM schedule calculator service account#11341
Create a MM schedule calculator service account#11341ElenaKarolinaSemanova wants to merge 1 commit intoredhat-appstudio:mainfrom
Conversation
Create a service account with appropriate perms for the mintmaker schedule calculator. Assisted-by: Cursor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ElenaKarolinaSemanova The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Review Summary by QodoAdd mintmaker schedule calculator service account RBAC
WalkthroughsDescription• Create service account for mintmaker schedule calculator • Define Role with read permissions for configmaps and cronjobs • Bind Role to ServiceAccount via RoleBinding • Register new RBAC resource in kustomization manifest Diagramflowchart LR
SA["ServiceAccount<br/>mintmaker-schedule-calculator-manager"]
Role["Role<br/>mintmaker-schedule-calculator-manager-role"]
RB["RoleBinding<br/>mintmaker-schedule-calculator-manager-rolebinding"]
CM["ConfigMaps<br/>get, list, watch"]
CJ["CronJobs<br/>get, list, watch"]
SA -- "bound by" --> RB
RB -- "references" --> Role
Role -- "grants access to" --> CM
Role -- "grants access to" --> CJ
File Changes1. components/mintmaker/base/rbac/kustomization.yaml
|
Code Review by Qodo
1. Overbroad read permissions
|
Kustomize Render DiffComparing
Total: 12 components, +588 -0 lines 📋 Full diff available in the workflow summary and as a downloadable artifact. |
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| rules: | ||
| - apiGroups: | ||
| - '' | ||
| resources: | ||
| - configmaps | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - batch | ||
| resources: | ||
| - cronjobs | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch |
There was a problem hiding this comment.
1. Overbroad read permissions 🐞 Bug ⛨ Security
Role mintmaker-schedule-calculator-manager-role grants list/watch on all ConfigMaps and CronJobs in the mintmaker namespace, which allows any pod using this ServiceAccount to read all ConfigMap data and all CronJob specs in that namespace. This unnecessarily increases blast radius compared to existing patterns in this repo that restrict ConfigMap access via resourceNames.
Agent Prompt
### Issue description
`mintmaker-schedule-calculator-manager-role` currently grants namespace-wide `list`/`watch` on `configmaps` and `cronjobs`, which allows reading *all* ConfigMaps and CronJobs in `mintmaker`.
### Issue Context
This repo already uses narrower RBAC patterns (e.g., `resourceNames` for ConfigMaps) to reduce blast radius.
### Fix Focus Areas
- Restrict permissions to specific resources (use `resourceNames` for ConfigMaps/CronJobs if the set is known) and/or drop `list`/`watch` if not strictly required.
- components/mintmaker/base/rbac/mintmaker-schedule-calculator-manager.yaml[12-28]
- (Example pattern) components/konflux-info/base/rbac.yaml[6-17]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #11341 +/- ##
=======================================
Coverage 51.62% 51.62%
=======================================
Files 18 18
Lines 1263 1263
=======================================
Hits 652 652
Misses 539 539
Partials 72 72
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
Create a service account with appropriate perms
for the mintmaker schedule calculator.
Assisted-by: Cursor