Merge pull request #421 from karelyatin/OSPRH-4297

Do not allow arbitary hostPath mounts via spec.extraMounts
openstack-k8s-operators · Oct 8, 2024 · 29b4baf · 29b4baf
2 parents 1a2449d + 41b5ae7
commit 29b4baf
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -235,7 +235,6 @@ rules:
   - security.openshift.io
   resourceNames:
   - anyuid
-  - hostmount-anyuid
   resources:
   - securitycontextconstraints
   verbs:

diff --git a/controllers/neutronapi_controller.go b/controllers/neutronapi_controller.go
@@ -102,7 +102,7 @@ type NeutronAPIReconciler struct {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;hostmount-anyuid,resources=securitycontextconstraints,verbs=use
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch;patch
 
 // Reconcile - neutron api
@@ -763,7 +763,7 @@ func (r *NeutronAPIReconciler) reconcileNormal(ctx context.Context, instance *ne
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid", "hostmount-anyuid"},
+			ResourceNames: []string{"anyuid"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},