A potential risk in volcano that could lead to takeover of the cluster about volcano HOT 10 CLOSED

Glad to receive your feedback! Volcano uses a standard serviceAccount & RBAC rule to grant pod permissions, and seems that k8s has some measures to avoid serviceaccount permission issue like https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection, is this can satisfy your need?

from volcano.

from volcano.

I found a ClusterRole named "Volcanic-controllers" found in the volcano project code, which has the list secrets permission. Is granting clusterRole list secrets permission necessary in this project? Marty Mcfly @.> 于2024年4月29日周一 10:43写道：
…
Glad to receive your feedback! Volcano uses a standard serviceAccount & RBAC rule to grant pod permissions, and seems that k8s has some measures to avoid serviceaccount permission issue like https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection, is this can satisfy your need? — Reply to this email directly, view it on GitHub <#3446 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/BBBY3LTWUNUPSTSLULLRGO3Y7WXTNAVCNFSM6AAAAABG4Z6BTSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOBRG44TQNRTHE . You are receiving this because you authored the thread.Message ID: @.>

Seems that volcano controller only used GET and CREATE verbs currently: )

from volcano.

Maybe we can remove list permission of volcano controller.

from volcano.

/good-first-issue

from volcano.

@Monokaix:
This request has been marked as suitable for new contributors.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-good-first-issue command.

from volcano.

from volcano.

fixed by #3449

from volcano.

/close

from volcano.

@Monokaix: Closing this issue.

from volcano.