From 341aba27235d868f2f360f043bd5ce2d09b50df7 Mon Sep 17 00:00:00 2001 From: Aman Raj Date: Sat, 27 Jun 2026 02:26:45 +0530 Subject: [PATCH] Remove unnecessary pods delete permission from ClusterRole The descheduler ClusterRole granted both pods:delete and pods/eviction:create. Eviction goes through the eviction subresource (PolicyV1().Evictions().Evict, requiring pods/eviction:create), and there are no direct pod Delete calls anywhere in the codebase, so the pods:delete verb is unused. Drop it to follow least privilege. Signed-off-by: Aman Raj --- charts/descheduler/templates/clusterrole.yaml | 2 +- kubernetes/base/rbac.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/descheduler/templates/clusterrole.yaml b/charts/descheduler/templates/clusterrole.yaml index 68ae90787..3a36d23e6 100644 --- a/charts/descheduler/templates/clusterrole.yaml +++ b/charts/descheduler/templates/clusterrole.yaml @@ -17,7 +17,7 @@ rules: verbs: ["get", "watch", "list"] - apiGroups: [""] resources: ["pods"] - verbs: ["get", "watch", "list", "delete"] + verbs: ["get", "watch", "list"] - apiGroups: [""] resources: ["pods/eviction"] verbs: ["create"] diff --git a/kubernetes/base/rbac.yaml b/kubernetes/base/rbac.yaml index a87e99415..551e198e2 100644 --- a/kubernetes/base/rbac.yaml +++ b/kubernetes/base/rbac.yaml @@ -15,7 +15,7 @@ rules: verbs: ["get", "watch", "list"] - apiGroups: [""] resources: ["pods"] - verbs: ["get", "watch", "list", "delete"] + verbs: ["get", "watch", "list"] - apiGroups: [""] resources: ["pods/eviction"] verbs: ["create"]