Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add optional rbac.secrets value to give GET/LIST/WATCH on Secrets #790

Merged
merged 3 commits into from
May 1, 2024
Merged

feat: add optional rbac.secrets value to give GET/LIST/WATCH on Secrets #790

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3cd11df
modified role template to allow SA to read k8s secrets in airflow ns
ashsrinivas-deloitte Oct 4, 2023
ab37685
feat: modified role template to allow SA to read k8s secrets in airfl…
ashsrinivas-deloitte Oct 4, 2023
cb659ab
cleanup changes
thesuperzapper May 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion charts/airflow/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -407,7 +407,8 @@ Parameter | Description | Default
Parameter | Description | Default
--- | --- | ---
`rbac.create` | if Kubernetes RBAC resources are created | `true`
`rbac.events` | if the created RBAR role has GET/LIST access to Event resources | `false`
`rbac.events` | if the created RBAC Role has GET/LIST on Event resources | `true`
`rbac.secrets` | if the created RBAC Role has GET/LIST/WATCH on Secret resources | `false`

</details>

Expand Down
10 changes: 10 additions & 0 deletions charts/airflow/templates/rbac/airflow-role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,16 @@ rules:
- "get"
- "list"
{{- end }}
{{- if .Values.rbac.secrets }}
- apiGroups:
- ""
resources:
- secrets
verbs:
- "get"
- "list"
- "watch"
{{- end }}
- apiGroups:
- ""
resources:
Expand Down
7 changes: 7 additions & 0 deletions charts/airflow/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1602,6 +1602,8 @@ rbac:
## if Kubernetes RBAC resources are created
## - these allow the service account to create/delete Pods in the airflow namespace,
## which is required for the KubernetesPodOperator() to function
## - if `false`, you must create a custom Role and RoleBinding
## for the ServiceAccount defined in `serviceAccount.name`
##
create: true

Expand All @@ -1610,6 +1612,11 @@ rbac:
##
events: true

## if the created RBAC Role has GET/LIST/WATCH on Secret resources
## - [WARNING] when true, workers/dags can read Secrets in airflow's namespace
##
secrets: false

###################################
## CONFIG | Kubernetes ServiceAccount
###################################
Expand Down
Loading