Use RBAC Roles and RoleBindings instead of ClusterRoles

[kitos9112]

Hi!

I'm looking into using this operator in our production system, but I'm concerned about given super privs on granting a clusterRole for watching events (e.g., update secret) in a specific namespace. Is this something you're considering working on? or it's already available and I'm not able to make it work?

Thanks!

[diafour]

Hello! Examples are using ClusterRoles for simplicity or to watch for namespaces and cluster scoped CRDs. There is no requirement of ClusterRoles for shell-operator, you can define RoleBindings depending on bindings in your hooks.

Please attach more information to help you: hooks configuration, RBAC definitions, logs.

[kitos9112]

Hi @diafour

Mea culpa, I had to explicitly specify the namespace selector in the Kubernetes config. I think an example with this would be beneficial as well. I'll see if I can open an PR covering #131 and leveraging roles and roleBindings too.

namespace:
  nameSelector:
    matchNames: ["${KUBERNETES_NAMESPACE}"]