The RBAC is rather wide for kube-vip and KVCP , each has a clusterrole and a clusterrolebinding.
Reading all services / nodes / pods in the cluster may be needed, but modifying configmap and leases should really be locked down to just the namespace where the release is installed if possible.
The RBAC is rather wide for kube-vip and KVCP , each has a clusterrole and a clusterrolebinding.
Reading all services / nodes / pods in the cluster may be needed, but modifying configmap and leases should really be locked down to just the namespace where the release is installed if possible.