Bug 2066674

Summary:	[ingress-operator] - Minimize wildcard/privilege Usage in Cluster and Local Roles
Product:	OpenShift Container Platform	Reporter:	Simon Reber <sreber>
Component:	Networking	Assignee:	aos-network-edge-staff <aos-network-edge-staff>
Networking sub component:	router	QA Contact:	Hongan Li <hongli>
Status:	CLOSED WONTFIX	Docs Contact:
Severity:	low
Priority:	low	CC:	hongli, mfisher, mmasters
Version:	4.8
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-19 20:56:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Simon Reber 2022-03-22 10:10:41 UTC

According http://static.open-scap.org/ssg-guides/ssg-ocp4-guide-cis.html#xccdf_org.ssgproject.content_rule_rbac_wildcard_use the usage of wildcard in ClusterRole and Roles should be prevented as best as possible.

Further, one should refrain from using `cluster-admin` permissions to comply with CIS security requirements.

It's therefore requested to review the below serviceAccount and their associated Roles as they were found not to be compliant with the above and restrict permissions further to the extend possible.

 - system:serviceaccount:openshift-ingress-operator:ingress-operator

Comment 1 Miciah Dashiel Butler Masters 2022-03-22 16:59:00 UTC

Setting blocker-.  

I have the same questions for this BZ as I have for bug 2066670:  

> Further, one should refrain from using `cluster-admin` permissions to comply
> with CIS security requirements.

Which clusterrole or binding is this referring to?  

Is this request part of a larger audit of cluster operators?

Comment 4 mfisher 2022-12-19 20:56:19 UTC

This issue is stale and has been closed because it has been open 90 days or more with no noted activity/comments in the last 60 days.  If this issue is crucial and still needs resolution, please open a new jira issue and the engineering team will triage and prioritize accordingly.