Stop using "cluster admin" role and restrict to k8s namespace (#3618)

apache · Sep 21, 2020 · a3cda19 · a3cda19
1 parent c6f634b
commit a3cda19
Showing 1 changed file with 36 additions and 5 deletions.
diff --git a/deploy/kubernetes/helm/templates/tools.yaml b/deploy/kubernetes/helm/templates/tools.yaml
@@ -217,21 +217,52 @@ metadata:
     k8s-app: {{ .Release.Name }}-apiserver
 
 ---
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
 metadata:
   name: {{ .Release.Name }}-apiserver
   labels:
     app: {{ .Release.Name }}-apiserver
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects: 
+  kind: Role
+  name: {{ .Release.Name }}-apiserver
+subjects:
 - kind: ServiceAccount
   name: {{ .Release.Name }}-apiserver
   namespace: {{ .Release.Namespace }}
 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-apiserver
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+
 ---
 apiVersion: v1
 kind: Service