grant create on Secrets through a namespaced Role in the operator namespace

The `create` verb was part of the ClusterRole of the `Role` controller, which allowed the operator to create Secrets in every namespace. It is only needed for the password fingerprint key Secret in the operator namespace. The Quarkus Kubernetes extension now generates a namespaced Role and RoleBinding for it. The default RoleBinding to the `view` ClusterRole is kept explicitly, because configured role bindings replace it.

Author: ThoSap

docs/role.md

@@ -56,7 +56,8 @@ On each reconcile it compares the referenced Secret against that fingerprint. Wh
 
 The fingerprint is an `HMAC-SHA256`. Its key is random and private to the operator.  
 The operator generates the key once and stores it in a Secret named `postgresql-operator-password-fingerprint-key` in its own namespace. A reader of the `Role` status learns nothing about the password without that key.  
-The Secret name is set by the configuration property `postgresql-operator.password-fingerprint.secret-name`, for example through the environment variable `POSTGRESQL_OPERATOR_PASSWORD_FINGERPRINT_SECRET_NAME`.
+The Secret name is set by the configuration property `postgresql-operator.password-fingerprint.secret-name`, for example through the environment variable `POSTGRESQL_OPERATOR_PASSWORD_FINGERPRINT_SECRET_NAME`.  
+The Helm chart grants `create` on Secrets through a `Role` and `RoleBinding` in the operator namespace only. The `ClusterRole` of the operator keeps read access to Secrets.
 
 **Consequences:**
 

operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleReconciler.java

@@ -37,8 +37,9 @@
         @RBACRule(
                 apiGroups = {""},
                 resources = {"secrets"},
-                // "create" is needed once for the password fingerprint key Secret in the operator namespace
-                verbs = {"get", "list", "watch", "create"}
+                // `create` for the password fingerprint key Secret is granted by a namespaced Role in the operator namespace,
+                // see `quarkus.kubernetes.rbac` in application.yml. It does not belong in this ClusterRole.
+                verbs = {"get", "list", "watch"}
         )
 })
 @RequiredArgsConstructor

operator/src/main/resources/application.yml

@@ -220,3 +220,22 @@ quarkus:
         QUARKUS_CONSOLE_COLOR: ${quarkus.console.color}
         QUARKUS_LOG_CONSOLE_JSON_ENABLED: ${quarkus.log.console.json.enabled}
         QUARKUS_LOG_CONSOLE_JSON_LOG_FORMAT: ${quarkus.log.console.json.log-format}
+    rbac:
+      # The operator creates the password fingerprint key Secret in its own namespace.
+      # `create` on Secrets is granted through this namespaced Role only, not through the ClusterRole of the Role controller,
+      # which would allow the operator to create Secrets in every namespace.
+      # `api-groups` is omitted, so the rule targets the core API group.
+      roles:
+        postgresql-operator-password-fingerprint-key:
+          policy-rules:
+            create-secrets:
+              resources: secrets
+              verbs: create
+      role-bindings:
+        postgresql-operator-password-fingerprint-key:
+          role-name: postgresql-operator-password-fingerprint-key
+        # The kubernetes-client extension stops generating its default binding to the `view` ClusterRole as soon as
+        # `role-bindings` are configured. This entry keeps that binding, so that the chart does not lose it.
+        postgresql-operator-view:
+          role-name: view
+          cluster-wide: true

operator/src/test/java/it/aboutbits/postgresql/helm/HelmTest.java

@@ -156,6 +156,8 @@ void helmInstall_createsDeployment() throws IOException {
         assertThat(chartPath.resolve("templates/clusterrole.yaml")).exists();
         assertThat(chartPath.resolve("templates/clusterrolebinding.yaml")).exists();
         assertThat(chartPath.resolve("templates/deployment.yaml")).exists();
+        // The namespaced Role that grants `create` on the password fingerprint key Secret
+        assertThat(chartPath.resolve("templates/role.yaml")).exists();
         assertThat(chartPath.resolve("templates/rolebinding.yaml")).exists();
         assertThat(chartPath.resolve("templates/service.yaml")).exists();
         assertThat(chartPath.resolve("templates/serviceaccount.yaml")).exists();