HI team, we are looking at the rbac.yaml file for propeller. There is one rule confusing to us. It seems that it allows most verbs from all resources and all apiGroups, which might overwrite other rules.

# Allow Access All plugin objects
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
  - patch

Please help take a look. Thanks! @Yubo Wang

i might be wrong but iirc that’s just there because some people might choose to replace it, and specify each plugin’s resource separately.

That makes sense

and in that case, that block can go, but it still needs the other sections in that yaml file, like the abilities on flyteworkflows crd etc

@Yee Another question: Does flyteadmin need * verbs for the following:

- apiGroups:
  - ""
  - <http://flyte.lyft.com|flyte.lyft.com>
  - <http://rbac.authorization.k8s.io|rbac.authorization.k8s.io>
  resources:
  - configmaps
  - flyteworkflows
  - namespaces
  - pods
  - resourcequotas
  - roles
  - rolebindings
  - secrets
  - services
  - serviceaccounts
  - spark-role
  verbs:
  - '*'

I don’t recall that admin needs that much power?🤔

probably not.

@Yee ah that is awesome. Thanks for the detailed explanation. We will turn it off for now since we are building a MVP that will only provision to a single pre-exist namespace.

it’s also possible to change how the namespacing construct works

yeah, we did the override, we set it to be a specific namespace that preexists

awesome