Operator attempts to list all namespaces, fails, after 1Pass item update

[1password]

Operator attempts to list all namespaces, fails, after 1Pass item update

[villesau]

@jillianwilson I'm not 100% sure but I think this is the culprit: https://github.com/1Password/onepassword-operator/blob/b574e394ad649d2cbf6f61192f00a1918cef8df3/pkg/onepassword/secret_update_handler.go#L164

If the namespaces are given explicitly, there shouldn't be a need to list all of them, right?

[parente]

The deployment example included in the 1Password/onepassword-operator repository uses ClusterRoleBindings instead which may work around the issue when the operator attempts to list all namespaces:

https://github.com/1Password/onepassword-operator/blob/b50d864b50760e3980d314b11db736dee8bd147b/deploy/permissions_multi_namespace_example.yaml#L6

[villesau]

I'm seeing this even with namespaced secrets and it prevents from updating secrets at all. Not sure why the namespaces needs listing when updating a secret in 1pw? In our setups we've given permission to two namespaces, in which the other is the operator namespace and set autoUpdate to true. Would be good if the operator could live without ClusterRoleBinding when the namespaces are defined.

I suspect that this is actually an issue with the operator and not with the helm chart since the operator should not need to list the namespaces if explicit list of them is given.

[jillianwilson]

Hi there, thank you for bringing this issue to our attention, we are currently investigating.

[jillianwilson]

@villesau I originally suspected that as well, but after some investigation I was also running into issues with listing deployments and secrets which can not be avoided. I'm now thinking this might be more of a configuration issue with permissions in the helm chart itself.

[SimonBarendse]

Could we change those list operations to list the deployments and secrets in the watched namespaces specifically? We could then add a list permission for deployments so the operator is allowed to list deployments within the watched namespaces via the role binding.

[fractos]

Hit this one a couple of EKS clusters. OnePassword is configured with watchNamespace parameters which stops it from applying the ClusterRoleBinding, therefore it doesn't have the permissions it needs to retrieve the list of namespaces when it is looking for an updated list. To fix this, we call the chart from Helm and have a local ClusterRoleBinding file that applies it arbitrarily. I might be missing some nuance, here, but now it works as expected.

[villesau]

I, too, have watchNamespace set to watch some namespaces so that description would match to my case as well.

[alexbescond]

Any updates on this issue?