Nguyen Minh Phuc
50c2fe2a1e
ci / lint (push) Successful in 1m19s
ci / unit (push) Failing after 1m2s
ci / integration (push) Has been skipped
ci / types (push) Successful in 1m37s
ci / security (push) Failing after 38s
ci / dockerfile (push) Successful in 14s
ci / image (api) (push) Has been skipped
ci / image (reconciler) (push) Has been skipped
ci / image (worker) (push) Has been skipped
ci / bump (push) Has been skipped
Complete working build of the system learn-python/ teaches. 164 tests, mypy --strict clean, domain coverage 99%.
53 lines
2.0 KiB
YAML
53 lines
2.0 KiB
YAML
{{- if .Values.rbac.create }}
|
|
{{/*
|
|
Hand-written, and deliberately short.
|
|
|
|
Why ClusterRole and not Role: the worker's job is to `helm upgrade --install` a tenant
|
|
release into a namespace it creates. `namespaces` is a cluster-scoped resource — a
|
|
namespaced Role cannot grant `create` on it, and cannot grant anything inside the tenant
|
|
namespaces either, because they do not exist when the chart is installed.
|
|
|
|
What keeps this least-privilege is not the scope, it is the contents: every resource and
|
|
verb is named, there is no `*`, no cluster-admin, and no rbac.authorization.k8s.io group.
|
|
That last omission is the load-bearing one — the worker cannot escalate itself, because it
|
|
cannot create a RoleBinding at all.
|
|
|
|
The reconciler binds to the same role but only ever reads; it enqueues tasks, it does not
|
|
provision, and it never deletes an orphan.
|
|
*/}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ include "svcforge.fullname" . }}-provisioner
|
|
labels:
|
|
{{- include "svcforge.labels" . | nindent 4 }}
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: [namespaces]
|
|
verbs: [get, list, create]
|
|
- apiGroups: [""]
|
|
resources: [secrets, services, configmaps, persistentvolumeclaims, serviceaccounts]
|
|
verbs: [get, list, watch, create, update, patch, delete]
|
|
- apiGroups: [apps]
|
|
resources: [deployments, statefulsets]
|
|
verbs: [get, list, watch, create, update, patch, delete]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ include "svcforge.fullname" . }}-provisioner
|
|
labels:
|
|
{{- include "svcforge.labels" . | nindent 4 }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ include "svcforge.fullname" . }}-provisioner
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" "worker") }}
|
|
namespace: {{ .Release.Namespace }}
|
|
- kind: ServiceAccount
|
|
name: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" "reconciler") }}
|
|
namespace: {{ .Release.Namespace }}
|
|
{{- end }}
|