Description
The addon framework deploys a ClusterRoleBinding that grants cluster-admin to the dynamic-scoring-agent-sa ServiceAccount on each managed cluster. This is broader than what the agent needs to function.
The agent only requires:
- Read access to Prometheus metrics (e.g., cluster-monitoring-view)
- Read access to Secrets and ConfigMaps in the agent's namespace (for auth tokens and scoring config)
- Create/Update access to AddOnPlacementScores on the hub (for reporting scores)
Risk
Any compromise of the agent pod grants full cluster-admin access to the managed cluster.
Suggested Fix
Replace the cluster-admin reference in clusterrolebinding.yaml with a scoped ClusterRole that grants only the permissions listed above. This would require adding a new ClusterRole template to the manifests.
Description
The addon framework deploys a ClusterRoleBinding that grants cluster-admin to the dynamic-scoring-agent-sa ServiceAccount on each managed cluster. This is broader than what the agent needs to function.
The agent only requires:
Risk
Any compromise of the agent pod grants full cluster-admin access to the managed cluster.
Suggested Fix
Replace the cluster-admin reference in clusterrolebinding.yaml with a scoped ClusterRole that grants only the permissions listed above. This would require adding a new ClusterRole template to the manifests.