---
id: w7/m7/t002
title: Audit + scope the bex-api ServiceAccount RBAC; narrow any over-broad grants
worker: worker7
status: todo
estimate: 45m
depends_on: []
---

## Objective

Audit the Kubernetes RBAC granted to bex-api's ServiceAccount and narrow anything broader than its actual use. bex-api reconciles App/Database/KeyValue CRs, reads status, and uses OpenBao k8s-auth (its projected SA token) for tenant env-vars — it should not carry a cluster-wide unrestricted Secret read (tenant secrets live in OpenBao, not k8s Secrets it must enumerate). Confirm and tighten.

## Context

- bex-api RBAC manifests: check `deploy/gitops/` (bex deployment) and any `lego/operator/config/` RBAC that covers the api ServiceAccount, plus `lego/backend/cmd/api` for what the process actually reads/writes via the k8s client.
- bex-api's Secret needs are narrow: it mostly talks to CRs + external services (OpenBao, Hydra, Kratos, Prometheus over HTTP). Any k8s Secret access should be scoped to what it genuinely reads (e.g. datastore connection Secrets it surfaces in connection-info), not all Secrets everywhere.
- The OpenBao login uses the SA's *projected token*, which is a ServiceAccount identity, not a Secret RBAC grant — don't conflate the two.

## Steps

1. Locate bex-api's ServiceAccount + (Cluster)Role/RoleBindings; list every granted apiGroup/resource/verb.
2. Cross-check against what the process actually calls; flag any grant with no corresponding code path (especially cluster-wide secrets/`*`).
3. Narrow the over-broad grants (namespace scope / specific resources / verbs); keep bex-api functional (CR reconcile, connection-info reveal, OpenBao auth).

## Files

- bex-api RBAC manifests (`deploy/gitops/` and/or `lego/operator/config/`)
- read-only cross-check of `lego/backend/cmd/api` + the services that use the k8s client

## Acceptance criteria

- [ ] bex-api's granted RBAC is enumerated and each grant maps to a real code path; unused/over-broad grants removed.
- [ ] No cluster-wide unrestricted Secret read remains for bex-api; the service still reconciles CRs, reveals connection-info, and authenticates to OpenBao.

## Out of scope

- Operator RBAC (t001); the CI guard (t003).
