Remove list permission for secrets:

This is unneeded and a potential security risk. Signed-off-by: Jacob Weinstock <[email protected]>
tinkerbell · Jun 4, 2024 · 36b127c · 36b127c
1 parent 81557c0
commit 36b127c
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -10,7 +10,6 @@ rules:
   - secrets
   verbs:
   - get
-  - list
   - watch
 - apiGroups:
   - bmc.tinkerbell.org

diff --git a/controller/machine.go b/controller/machine.go
@@ -60,7 +60,7 @@ func NewMachineReconciler(c client.Client, recorder record.EventRecorder, bmcCli
 //+kubebuilder:rbac:groups=bmc.tinkerbell.org,resources=machines,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=bmc.tinkerbell.org,resources=machines/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=bmc.tinkerbell.org,resources=machines/finalizers,verbs=update
-//+kubebuilder:rbac:groups="",resources=secrets;,verbs=get;list;watch
+//+kubebuilder:rbac:groups="",resources=secrets;,verbs=get;watch
 
 // Reconcile reports on the state of a Machine. It does not change the state of the Machine in any way.
 // Updates the Power status and conditions accordingly.
-Original file line number
+Diff line change
@@ Expand Up / @@ -10,7 +10,6 @@ rules: @@
       - secrets
       verbs:
       - get
-      - list
       - watch
     - apiGroups:
       - bmc.tinkerbell.org
@@ Expand Down @@