miki3421 opened a new pull request, #239: URL: https://github.com/apache/openserverless-task/pull/239
## Problem and change Related to apache/openserverless#277. Existing monitoring roles grant kube-state-metrics cluster-wide Secret list/watch access. Updating only the operator image does not reliably reconcile those cluster-scoped permissions. Remove those permissions and apply the reduced monitoring role from the administrator-owned `operator-update` task before updating/restarting the operator. This does not grant the operator additional RBAC privileges. This is the task half of the coordinated monitoring isolation fix; the companion operator PR will be linked here. Both should ship together on `0.9.0`. An image-only upgrade must explicitly apply the updated role first. ## Validation - RBAC manifest is byte-identical to the companion operator manifest. - K3s live validation confirmed Secret access is denied for the collector service account while intended monitoring remains functional. - The complete paired candidate passes 88 operator unit tests; existing lab regression results are documented in the linked issue. - Diff is limited to the monitoring role and its reconciliation in the existing update task. No component versions or application code changed. The exact public update command with a released image and a fresh full-cluster installation were not rerun in this iteration. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
