Skip to content

fix(helm): explode verbs instead of wildcarding #7405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 4, 2023
Merged

fix(helm): explode verbs instead of wildcarding #7405

merged 1 commit into from
May 4, 2023

Conversation

johnstcn
Copy link
Member

@johnstcn johnstcn commented May 4, 2023 •
edited
Loading

Kubernetes considers * to be of higher value than [create delete deletecollection get list patch update watch] which can lead to failures during installation if the user does not have the magic * permission on resources pods and persistentvolumeclaims.

Fix: explode the permissions explicitly in the role.

Validation (air-gapped cluster):

$ KUBECONFIG=~/src/kadduser/cian.kubeconfig helm install -n cian-ns coderv2 . --set coder.image.repo=reg.home:5000/ghcr.io/coder/coder --set coder.image.tag=v0.22.2
[...]
NOTES:
Enjoy Coder! Please create an issue at https://github.com/coder/coder if you run
into any problems! :)

$ helm list -n cian-ns
NAME   	NAMESPACE	REVISION	UPDATED                             	STATUS  	CHART      	APP VERSION
coderv2	cian-ns  	1       	2023-05-04 11:40:28.569403 +0100 IST	deployed	coder-0.1.0	0.1.0     

$ k -n cian-ns get role coder-workspace-perms -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    meta.helm.sh/release-name: coderv2
    meta.helm.sh/release-namespace: cian-ns
  creationTimestamp: "2023-05-04T10:42:29Z"
  labels:
    app.kubernetes.io/managed-by: Helm
  name: coder-workspace-perms
  namespace: cian-ns
  resourceVersion: "522562"
  uid: 69a1b2c2-b2ff-496f-b922-6ac1eb63d87b
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - persistentvolumeclaims
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch

@johnstcn johnstcn requested a review from deansheather May 4, 2023 10:35
@johnstcn johnstcn self-assigned this May 4, 2023
@johnstcn johnstcn enabled auto-merge (squash) May 4, 2023 10:45
@johnstcn johnstcn merged commit b4d913e into main May 4, 2023
@johnstcn johnstcn deleted the cj/helm-role-explode-verbs branch May 4, 2023 10:45
@github-actions github-actions bot locked and limited conversation to collaborators May 4, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@deansheather deansheather deansheather approved these changes

Assignees

@johnstcn johnstcn

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@johnstcn @deansheather