helm RBAC should be more restrictive #827
Labels
Comments
TheKangaroo
added a commit
to TheKangaroo/sealed-secrets
that referenced
this issue
Apr 21, 2022
add rbac name selector for get service permission in the helm chart. this was missing in bitnami-labs#715 fixes: bitnami-labs#827 Signed-off-by: Till Adam <[email protected]>
Merged
alvneiayu
added
backlog
|
Thanks for creating a PR! Let's continue there. |
TheKangaroo
added a commit
to TheKangaroo/sealed-secrets
that referenced
this issue
May 5, 2022
add rbac name selector for get service permission in the helm chart. this was missing in bitnami-labs#715 fixes: bitnami-labs#827 Signed-off-by: Till Adam <[email protected]>
alemorcuq
pushed a commit
that referenced
this issue
May 5, 2022
add rbac name selector for get service permission in the helm chart. this was missing in #715 fixes: #827 Signed-off-by: Till Adam <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Which component:
controller
Describe the bug
This PR #715 added the
get servicepermission tosystem:authenticatedwhich is needed to lookup the named port of the service.While this works as expected I think the helm chart is missing the restriction to the resource name of the service. This in turn will allow every authenticated user to
getany service in the same namespace as sealed-secrets is deployed.Expected behavior
I think this should be limited to just "sealed-secrets-controller" like in the
controller.jsonnetfile in the same PR.Additional context
I'll happily provide a PR fix for this :)
The text was updated successfully, but these errors were encountered: