{"action":"opened","issue":{"url":"https://api.github.com/repos/linkerd/linkerd2/issues/1341","repository_url":"https://api.github.com/repos/linkerd/linkerd2","labels_url":"https://api.github.com/repos/linkerd/linkerd2/issues/1341/labels{/name}","comments_url":"https://api.github.com/repos/linkerd/linkerd2/issues/1341/comments","events_url":"https://api.github.com/repos/linkerd/linkerd2/issues/1341/events","html_url":"https://github.com/linkerd/linkerd2/issues/1341","id":341753697,"node_id":"MDU6SXNzdWUzNDE3NTM2OTc=","number":1341,"title":"Control plane CA requests privileges that are too broad","user":{"login":"briansmith","id":16816,"node_id":"MDQ6VXNlcjE2ODE2","avatar_url":"https://avatars0.githubusercontent.com/u/16816?v=4","gravatar_id":"","url":"https://api.github.com/users/briansmith","html_url":"https://github.com/briansmith","followers_url":"https://api.github.com/users/briansmith/followers","following_url":"https://api.github.com/users/briansmith/following{/other_user}","gists_url":"https://api.github.com/users/briansmith/gists{/gist_id}","starred_url":"https://api.github.com/users/briansmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briansmith/subscriptions","organizations_url":"https://api.github.com/users/briansmith/orgs","repos_url":"https://api.github.com/users/briansmith/repos","events_url":"https://api.github.com/users/briansmith/events{/privacy}","received_events_url":"https://api.github.com/users/briansmith/received_events","type":"User","site_admin":false},"labels":[{"id":773710190,"node_id":"MDU6TGFiZWw3NzM3MTAxOTA=","url":"https://api.github.com/repos/linkerd/linkerd2/labels/area/controller","name":"area/controller","color":"0052CC","default":false},{"id":985143055,"node_id":"MDU6TGFiZWw5ODUxNDMwNTU=","url":"https://api.github.com/repos/linkerd/linkerd2/labels/area/tls","name":"area/tls","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":{"login":"briansmith","id":16816,"node_id":"MDQ6VXNlcjE2ODE2","avatar_url":"https://avatars0.githubusercontent.com/u/16816?v=4","gravatar_id":"","url":"https://api.github.com/users/briansmith","html_url":"https://github.com/briansmith","followers_url":"https://api.github.com/users/briansmith/followers","following_url":"https://api.github.com/users/briansmith/following{/other_user}","gists_url":"https://api.github.com/users/briansmith/gists{/gist_id}","starred_url":"https://api.github.com/users/briansmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briansmith/subscriptions","organizations_url":"https://api.github.com/users/briansmith/orgs","repos_url":"https://api.github.com/users/briansmith/repos","events_url":"https://api.github.com/users/briansmith/events{/privacy}","received_events_url":"https://api.github.com/users/briansmith/received_events","type":"User","site_admin":false},"assignees":[{"login":"briansmith","id":16816,"node_id":"MDQ6VXNlcjE2ODE2","avatar_url":"https://avatars0.githubusercontent.com/u/16816?v=4","gravatar_id":"","url":"https://api.github.com/users/briansmith","html_url":"https://github.com/briansmith","followers_url":"https://api.github.com/users/briansmith/followers","following_url":"https://api.github.com/users/briansmith/following{/other_user}","gists_url":"https://api.github.com/users/briansmith/gists{/gist_id}","starred_url":"https://api.github.com/users/briansmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briansmith/subscriptions","organizations_url":"https://api.github.com/users/briansmith/orgs","repos_url":"https://api.github.com/users/briansmith/repos","events_url":"https://api.github.com/users/briansmith/events{/privacy}","received_events_url":"https://api.github.com/users/briansmith/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-07-17T03:35:08Z","updated_at":"2018-07-17T03:35:08Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Currently the CA requests create/update access to every secret in every namespace and create/update access to the configmap named \"linkerd-ca-bundle\" in every namespace. This is too broad. In particular, it must be possible to install Conduit in a cluster while limiting which namespaces it is allowed to write secrets and this configmap to.\r\n\r\nProposal:\r\n* For the \"linkerd-ca-bundle\" configmap, now we create a `ClusterRoleBinding` during `linkerd install` that enables create/update access in every namespace. Instead, create a non-cluster `RoleBinding` during `linkerd inject` that enables create/update access to the configmap only in the same namespace.\r\n* For the secrets, now we create a `ClusterRoleBinding` that gives the CA write access to every secret in the system during `linkerd install`. Instead, during `linkerd inject`, create a `RoleBinding` that gives the controller access to every secret within that specific namespace.\r\n\r\nThis way, the CA would only have write acecss to the namespaces where pods are injected.\r\n\r\nRelated to #1336.\r\n\r\n@grampelberg @klingerf @olix0r Thoughts?"}}
{"actor":{"display_login":"briansmith"}}