OCPBUGS-15157: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole

manifests/machineconfigcontroller/clusterrole.yaml

@@ -7,22 +7,22 @@ rules:
   resources: ["nodes"]
   verbs: ["get", "list", "watch", "patch", "update"]
 - apiGroups: ["machineconfiguration.openshift.io"]
-  resources: ["*"]
-  verbs: ["*"]
+  resources: ["machineconfigs", "machineconfigs/status", "machineconfigpools", "machineconfigpools/status", "controllerconfigs", "controllerconfigs/status", "kubeletconfigs", "kubeletconfigs/status", "containerruntimeconfigs", "containerruntimeconfigs/status", "machineconfignodes", "machineconfignodes/status", "internalreleaseimages", "internalreleaseimages/status", "pinnedimagesets", "osimagestreams", "machineosconfigs", "machineosconfigs/status", "machineosbuilds", "machineosbuilds/status"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: ["machineconfiguration.openshift.io"]
+  resources: ["controllerconfigs/finalizers", "kubeletconfigs/finalizers", "containerruntimeconfigs/finalizers", "machineconfigpools/finalizers", "internalreleaseimages/finalizers", "machineosconfigs/finalizers", "machineosbuilds/finalizers"]
+  verbs: ["update"]
 - apiGroups: [""]
-  resources: ["configmaps", "secrets"]
-  verbs: ["*"]
-- apiGroups: ["config.openshift.io"]
-  resources: ["images", "clusterversions", "featuregates", "nodes", "nodes/status", "imagepolicies/status", "criocredentialproviderconfigs/status"]
-  verbs: ["*"]
+  resources: ["secrets"]
+  verbs: ["get", "list", "watch", "create", "update", "delete"]
 - apiGroups: ["config.openshift.io"]
-  resources: ["schedulers", "apiservers", "infrastructures", "imagedigestmirrorsets", "imagetagmirrorsets", "clusterimagepolicies", "imagepolicies", "criocredentialproviderconfigs"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["operator.openshift.io"]
-  resources: ["imagecontentsourcepolicies"]
+  resources: ["images", "clusterversions", "featuregates", "nodes", "schedulers", "apiservers", "infrastructures", "imagedigestmirrorsets", "imagetagmirrorsets", "clusterimagepolicies", "imagepolicies", "criocredentialproviderconfigs"]
   verbs: ["get", "list", "watch"]
+- apiGroups: ["config.openshift.io"]
+  resources: ["imagepolicies/status", "criocredentialproviderconfigs/status"]
+  verbs: ["get", "list", "watch", "update"]
 - apiGroups: ["operator.openshift.io"]
-  resources: ["etcds"]
+  resources: ["imagecontentsourcepolicies", "etcds", "machineconfigurations"]
   verbs: ["get", "list", "watch"]
 - apiGroups: [""]
   resources: ["pods/eviction"]
@@ -41,16 +41,7 @@ rules:
   verbs: ["get", "list", "watch", "patch"]
 - apiGroups: ["operator.openshift.io"]
   resources: ["machineconfigurations/status"]
-  verbs: ["*"]
-- apiGroups: ["operator.openshift.io"]
-  resources: ["machineconfigurations"]
-  verbs: ["get","list","watch"]
-- apiGroups: ["machineconfiguration.openshift.io"]
-  resources: ["machineosconfigs", "machineosconfigs/status"]
-  verbs: ["create", "update", "patch", "get"]
-- apiGroups: ["machineconfiguration.openshift.io"]
-  resources: ["machineosbuilds", "machineosbuilds/status"]
-  verbs: ["create", "update", "patch", "get"]
+  verbs: ["get", "update"]
 - apiGroups: ["aro.openshift.io"]
   resources: ["clusters"]
   verbs: ["get"]  
@@ -72,4 +63,6 @@ rules:
   resources:
   - leases
   verbs:
-  - "*"
+  - create
+  - get
+  - update

manifests/machineconfigcontroller/configmaps-role-target.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: machine-config-controller-configmaps
+  namespace: {{.TargetNamespace}}
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["get", "list", "watch", "create", "update", "delete"]

manifests/machineconfigcontroller/configmaps-rolebinding-target.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: machine-config-controller-configmaps
+  namespace: {{.TargetNamespace}}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: machine-config-controller-configmaps
+subjects:
+- kind: ServiceAccount
+  namespace: {{.TargetNamespace}}
+  name: machine-config-controller

pkg/operator/sync.go

@@ -94,6 +94,8 @@ const (
 	mccEventsClusterRoleManifestPath                                      = "manifests/machineconfigcontroller/events-clusterrole.yaml"
 	mccEventsRoleBindingDefaultManifestPath                               = "manifests/machineconfigcontroller/events-rolebinding-default.yaml"
 	mccEventsRoleBindingTargetManifestPath                                = "manifests/machineconfigcontroller/events-rolebinding-target.yaml"
+	mccConfigMapsRoleTargetManifestPath                                   = "manifests/machineconfigcontroller/configmaps-role-target.yaml"
+	mccConfigMapsRoleBindingTargetManifestPath                            = "manifests/machineconfigcontroller/configmaps-rolebinding-target.yaml"
 	mccClusterRoleBindingManifestPath                                     = "manifests/machineconfigcontroller/clusterrolebinding.yaml"
 	mccServiceAccountManifestPath                                         = "manifests/machineconfigcontroller/sa.yaml"
 	mccKubeRbacProxyConfigMapPath                                         = "manifests/machineconfigcontroller/kube-rbac-proxy-config.yaml"
@@ -1185,11 +1187,13 @@ func (optr *Operator) syncMachineConfigController(config *renderConfig, _ *confi
 		},
 		roles: []string{
 			mccKubeRbacProxyPrometheusRolePath,
+			mccConfigMapsRoleTargetManifestPath,
 		},
 		roleBindings: []string{
 			mccEventsRoleBindingDefaultManifestPath,
 			mccEventsRoleBindingTargetManifestPath,
 			mccKubeRbacProxyPrometheusRoleBindingPath,
+			mccConfigMapsRoleBindingTargetManifestPath,
 			mopRoleBindingManifestPath,
 		},
 		clusterRoleBindings: []string{