Audit and tighten ClusterRole RBAC permissions

[dorser]

Summary

The Helm chart's ClusterRole has an overly broad rule that may be unnecessary:

- apiGroups: ["*"]
  resources: ["deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs", "replicationcontrollers"]
  # Required to retrieve the owner references used by the seccomp gadget.
  verbs: ["get", "list", "watch", "create"]

Issues

1. apiGroups: ["*"] — Should be scoped to specific API groups (apps/v1, batch/v1, etc.)
2. create verb — The comment says it's for "owner references used by the seccomp gadget" but micromize doesn't use a seccomp gadget. This may be copy-pasted from Inspektor Gadget and be unnecessary.
3. Principle of least privilege — A security tool should model minimal permissions.

What's Needed

1. Audit which API permissions micromize actually uses
2. Remove unnecessary verbs (create if not needed)
3. Scope apiGroups to specific groups instead of wildcard
4. Update the comment to explain why each permission is needed

Files

• charts/micromize/templates/clusterrole.yaml