Gokul Kolady has posted comments on this change. ( http://gerrit.cloudera.org:8080/24419 )
Change subject: IMPALA-15049: Harden Impala Kubernetes operator RBAC permissions ...................................................................... Patch Set 28: (2 comments) http://gerrit.cloudera.org:8080/#/c/24419/28/helm/impala/README.md File helm/impala/README.md: http://gerrit.cloudera.org:8080/#/c/24419/28/helm/impala/README.md@294 PS28, Line 294: - control-plane permissions for `impalaclusters` status/finalizers and namespace creation This bullet says control-plane permissions include namespace creation, but rbac.yaml no longer grants namespace permissions and reconcile no longer auto-creates namespaces. Can we update this line to match the current least-privilege behavior? http://gerrit.cloudera.org:8080/#/c/24419/28/operator/impala-operator/tests/test_rbac_manifest.py File operator/impala-operator/tests/test_rbac_manifest.py: http://gerrit.cloudera.org:8080/#/c/24419/28/operator/impala-operator/tests/test_rbac_manifest.py@35 PS28, Line 35: self.assertNotIn('resources: ["namespaces"]', content) This check only rejects one exact string form (resources: ["namespaces"]). If namespaces is reintroduced in a combined list or different YAML formatting, this can false-pass. Can we make this assertion semantic (parse YAML and assert no rule contains namespaces) so the test actually guards the permission boundary? -- To view, visit http://gerrit.cloudera.org:8080/24419 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia3eafc1f4ddcda423227ad5fc361e0bbbd4dad19 Gerrit-Change-Number: 24419 Gerrit-PatchSet: 28 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Gokul Kolady <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Comment-Date: Tue, 04 Aug 2026 22:20:08 +0000 Gerrit-HasComments: Yes
