RBAC for Operators
Documentation states that cluster-admin is required for installing operators. Has anyone come up with an RBAC policy that allows a user to install operators without cluster-admin?
It just seems somewhat limiting for a developer to need to ask a cluster-admin to install an operator to just be able to test something out. Sure, it doesn't take hardly any effort to install, but the process and timing that can be wrapped around something like that might be extremely limiting.
EDIT: After reading the docs more closely, TIL you can grant cluster-admin at the namespace level. That actually helps for the use case we had in mind.
Posted May 1, 2020, 11:23 PM UTC · edited
13
It's possible to build such dedicated role, but having cluster admin as requirement makes perfectly sense to me. Think about it: what an Operator usually has? Some crds, deployment and rbac...cluster rbac. So allowing a dev to install an operator you would technically grant him write access to cluster rbac. Sky is the limit ;) Why not to modify the role you had created in the first place? Besides you should really have a control and knowledge what is installed in the cluster as an administrator. At the end you are responsibile for the platform.