fix(charts): least privilege on controller rbac

padok-team · Dec 2, 2024 · 8d83b44 · 8d83b44
1 parent 77c9f57
commit 8d83b44
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 37 deletions.
diff --git a/deploy/charts/burrito/templates/controllers.yaml b/deploy/charts/burrito/templates/controllers.yaml
@@ -143,7 +143,7 @@ metadata:
     {{- toYaml .metadata.annotations | nindent 4 }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   name: burrito-controllers
   labels:
@@ -158,22 +158,4 @@ subjects:
   - kind: ServiceAccount
     name: burrito-controllers
     namespace: {{ $.Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: burrito-controllers-secrets
-  namespace: {{ $.Release.Namespace }}
-  labels:
-    {{- toYaml .metadata.labels | nindent 4 }}
-  annotations:
-    {{- toYaml .metadata.annotations | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: burrito-controllers-secrets
-subjects:
-  - kind: ServiceAccount
-    name: burrito-controllers
-    namespace: {{ $.Release.Namespace }}
 {{- end }}
diff --git a/deploy/charts/burrito/templates/rbac-controllers.yaml b/deploy/charts/burrito/templates/rbac-controllers.yaml
@@ -43,6 +43,8 @@ rules:
   - list
   - create
   - update
+  - watch
+  - get
 - apiGroups:
   - config.terraform.padok.cloud
   resources:
@@ -160,21 +162,3 @@ rules:
   - update
   - patch
   - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/component: controllers
-    app.kubernetes.io/name: burrito-controllers
-    app.kubernetes.io/part-of: burrito
-  name: burrito-controllers-secrets
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - watch
-  - list
-  - get
diff --git a/deploy/charts/burrito/templates/tenant.yaml b/deploy/charts/burrito/templates/tenant.yaml
@@ -66,4 +66,21 @@ subjects:
 ---
 {{- end }}
 {{- end }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: burrito-controllers
+  labels:
+    {{- toYaml .Values.controllers.metadata.labels | nindent 4 }}
+  annotations:
+    {{- toYaml .Values.controllers.metadata.annotations | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: burrito-controllers
+subjects:
+  - kind: ServiceAccount
+    name: burrito-controllers
+    namespace: {{ $.Release.Namespace }}
+---
 {{- end }}