[AUT-10826] Istio authorizer cluster roles adjustments (#300)

* remove system:auth-delegator role, apply ClusterRole for scanning namespaces and deployments only if discovery is enabled * minor release * revert app version
cloudentity · Feb 1, 2024 · 7e60dc0 · 7e60dc0
1 parent 6f5d2ed
commit 7e60dc0
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 21 deletions.
diff --git a/charts/istio-authorizer/Chart.yaml b/charts/istio-authorizer/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: istio-authorizer
 description: A Helm chart for istio-authorizer
 type: application
-version: 2.21.0
+version: 2.21.1
 appVersion: "2.21.0"
diff --git a/charts/istio-authorizer/templates/clusterrole.yaml b/charts/istio-authorizer/templates/clusterrole.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.discovery.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -21,3 +22,4 @@ rules:
   - "deployments"
   verbs:
   - "list"
+{{- end }}
diff --git a/charts/istio-authorizer/templates/clusterrolebinding.yaml b/charts/istio-authorizer/templates/clusterrolebinding.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.discovery.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -17,23 +18,4 @@ subjects:
 - kind: ServiceAccount
   name: {{ include "istio-authorizer.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "istio-authorizer.serviceAccountName" . }}-auth-delegator
-  namespace: default
-  labels:
-    {{- include "istio-authorizer.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
-- kind: ServiceAccount
-  name: {{ include "istio-authorizer.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+{{- end }}