mirror of
https://github.com/kubernetes-sigs/descheduler.git
synced 2026-08-19 12:36:23 +00:00
Aman Raj
341aba2723
The descheduler ClusterRole granted both pods:delete and pods/eviction:create. Eviction goes through the eviction subresource (PolicyV1().Evictions().Evict, requiring pods/eviction:create), and there are no direct pod Delete calls anywhere in the codebase, so the pods:delete verb is unused. Drop it to follow least privilege. Signed-off-by: Aman Raj <aman.yug@gmail.com>