Skip to content

Conversation

@jgwest
Copy link
Member

@jgwest jgwest commented Dec 12, 2025

What type of PR is this?
/kind enhancement

What does this PR do / why we need it:

  • This PR introduces a utility script that can be used to audit the Roles/RoleBindings created by operator on cluster.
  • This is beneficial for end users to verify that that gitops operator roles/rolebindings have the expected access

@openshift-ci openshift-ci bot added the kind/enhancement New feature or request label Dec 12, 2025
@openshift-ci openshift-ci bot requested review from jannfis and trdoyle81 December 12, 2025 11:55
@jgwest jgwest force-pushed the add-audit-script-dec-2025 branch from 2a3bfaf to 2a3ef18 Compare December 12, 2025 12:10
@jgwest jgwest force-pushed the add-audit-script-dec-2025 branch from 2a3ef18 to 4b90d85 Compare December 12, 2025 12:20
Signed-off-by: Jonathan West <jonwest@redhat.com>
@jgwest jgwest force-pushed the add-audit-script-dec-2025 branch from 4b90d85 to ae0680c Compare December 12, 2025 12:23
@openshift-ci
Copy link

openshift-ci bot commented Dec 12, 2025

@jgwest: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/v4.14-kuttl-parallel ae0680c link true /test v4.14-kuttl-parallel

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

• ServiceAccount: example-argocd-application-controller (ns: my-argocd)
• Namespace my-argocd has access to app-ns
```
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we'd like to include a safe scan example

$ ./audit-operator-roles.sh
=========================================================
SEARCH CRITERIA (Must match ALL):
  1. API/Resource: argoproj.io / applications
  2. Label:        app.kubernetes.io/part-of=argocd
  3. Scope:        Cross-namespace only
=========================================================

Scanning Cluster (this may take a moment)...

Roles with cross-namespace access:
  • No cross-namespace bindings found for the candidate roles.
Scan Complete.

@svghadi
Copy link
Member

svghadi commented Dec 15, 2025

/lgtm

@svghadi
Copy link
Member

svghadi commented Dec 15, 2025

/retest
/approve

@openshift-ci
Copy link

openshift-ci bot commented Dec 15, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: svghadi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants