Skip to content

fix(helm): remove unused capture RBAC from hubble operator clusterrole - #2420

Merged
Quang Nguyen (nddq) merged 5 commits into
microsoft:mainfrom
slariviere:fix/hubble-remove-unused-capture-rbac
Aug 21, 2026
Merged

fix(helm): remove unused capture RBAC from hubble operator clusterrole#2420
Quang Nguyen (nddq) merged 5 commits into
microsoft:mainfrom
slariviere:fix/hubble-remove-unused-capture-rbac

Conversation

@slariviere

Copy link
Copy Markdown
Contributor

Description

The Capture CRD is not shipped with this chart, retina.sh/captures permissions are unused and constitute excess privilege. The same goes for the batch/jobs since they are used for that reason.

Related Issue

If this pull request is related to any issue, please mention it here. Additionally, make sure that the issue is assigned to you before submitting this pull request.

Checklist

  • I have read the contributing documentation.
  • I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
  • I have correctly attributed the author(s) of the code.
  • I have tested the changes locally.
  • I have followed the project's style guidelines.
  • I have updated the documentation, if necessary.
  • I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

Please add any relevant screenshots or GIFs to showcase the changes made.

Additional Notes

Add any additional notes or context about the pull request here.


Please refer to the CONTRIBUTING.md file for more information on how to contribute to this project.

@slariviere

Copy link
Copy Markdown
Contributor Author

orangejuice Quang Nguyen (@nddq), can we do anything to move this PR forward?

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Removes unused Hubble operator permissions to enforce least-privilege RBAC.

Changes:

  • Removes batch/jobs permissions.
  • Removes retina.sh/captures permissions.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@nddq Quang Nguyen (nddq) left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@nddq
Quang Nguyen (nddq) added this pull request to the merge queue Aug 21, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Aug 21, 2026
@nddq
Quang Nguyen (nddq) added this pull request to the merge queue Aug 21, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Aug 21, 2026
@nddq
Quang Nguyen (nddq) added this pull request to the merge queue Aug 21, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Aug 21, 2026
@nddq
Quang Nguyen (nddq) added this pull request to the merge queue Aug 21, 2026
Merged via the queue into microsoft:main with commit 2595f59 Aug 21, 2026
45 of 48 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants