From df1ec8b7500efd28e2b36b47434388b2ac1d95c5 Mon Sep 17 00:00:00 2001
From: Hawik <davapa@gmail.com>
Date: Thu, 8 Oct 2026 23:28:47 +0200
Subject: [PATCH] fix(chart): restrict ClusterRole to least-privilege
 permissions

Signed-off-by: Hawik <davapa@gmail.com>
---
 chart/templates/02-rbac.yaml | 64 +++++++++++++++++++++++++-----------
 docs/architecture.md         | 16 +--------
 2 files changed, 45 insertions(+), 35 deletions(-)

diff --git a/chart/templates/02-rbac.yaml b/chart/templates/02-rbac.yaml
index 560adcb..4062900 100644
--- a/chart/templates/02-rbac.yaml
+++ b/chart/templates/02-rbac.yaml
@@ -10,9 +10,17 @@ metadata:
   name: k8s-overcommit-clusterrole
 rules:
   - apiGroups:
-    - '*'
+    - ""
     resources:
-    - '*'
+    - events
+    verbs:
+    - create
+    - patch
+    - update
+  - apiGroups:
+    - ""
+    resources:
+    - pods
     verbs:
     - get
     - list
@@ -20,24 +28,23 @@ rules:
   - apiGroups:
     - ""
     resources:
-    - events
+    - namespaces
     verbs:
-    - create
-    - patch
-    - update
+    - get
+    - list
+    - watch
   - apiGroups:
     - ""
     resources:
     - services
-    - namespaces
     verbs:
     - create
+    - delete
     - get
     - list
-    - watch
-    - delete
-    - update
     - patch
+    - update
+    - watch
   - apiGroups:
     - admissionregistration.k8s.io
     resources:
@@ -45,12 +52,12 @@ rules:
     - validatingwebhookconfigurations
     verbs:
     - create
+    - delete
     - get
     - list
-    - watch
-    - delete
-    - update
     - patch
+    - update
+    - watch
   - apiGroups:
     - apps
     resources:
@@ -58,12 +65,12 @@ rules:
     - replicasets
     verbs:
     - create
+    - delete
     - get
     - list
-    - delete
+    - patch
     - update
     - watch
-    - update
   - apiGroups:
     - cert-manager.io
     resources:
@@ -77,9 +84,9 @@ rules:
     - update
     - watch
   - apiGroups:
-    - overcommit.inditex.dev
+    - coordination.k8s.io
     resources:
-    - "*"
+    - leases
     verbs:
     - create
     - delete
@@ -89,9 +96,10 @@ rules:
     - update
     - watch
   - apiGroups:
-    - "coordination.k8s.io"
+    - overcommit.inditex.dev
     resources:
-    - leases
+    - overcommitclasses
+    - overcommits
     verbs:
     - create
     - delete
@@ -100,6 +108,22 @@ rules:
     - patch
     - update
     - watch
+  - apiGroups:
+    - overcommit.inditex.dev
+    resources:
+    - overcommitclasses/finalizers
+    - overcommits/finalizers
+    verbs:
+    - update
+  - apiGroups:
+    - overcommit.inditex.dev
+    resources:
+    - overcommitclasses/status
+    - overcommits/status
+    verbs:
+    - get
+    - patch
+    - update
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -125,4 +149,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ $.Values.serviceAccount.name }}
-    namespace: {{ $.Values.namespace }}
\ No newline at end of file
+    namespace: {{ $.Values.namespace }}
diff --git a/docs/architecture.md b/docs/architecture.md
index 56ed30e..e9f074d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -274,21 +274,7 @@ func CalculateResources(limits corev1.ResourceList, class OvercommitClass) corev
 
 ### RBAC Permissions
 
-The operator requires minimal permissions:
-
-```yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: manager-role
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["overcommit.inditex.dev"]
-  resources: ["overcommits", "overcommitclasses"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-```
+The controller ClusterRole is defined in `config/rbac/role.yaml` (generated from kubebuilder markers). The Helm chart uses the same explicit rules, plus `namespaces` get/list/watch for label lookups, and keeps the binding to the built-in `view` ClusterRole for owner resolution.
 
 ### Certificate Management