fix: reduce permissions for cluster role (#54)

hirosystems · Sep 21, 2023 · 2ea50ea · 2ea50ea
1 parent ef1ebde
commit 2ea50ea
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 4 deletions.
diff --git a/templates/ci/stacks-devnet-api.template.yaml b/templates/ci/stacks-devnet-api.template.yaml
@@ -11,9 +11,11 @@ metadata:
   name: stacks-devnet-api-service-account
 rules:
   - apiGroups: [""]
-    # TODO: production version should not be able to create/delete namespaces (only get) 
-    resources: ["pods", "pods/status", "services", "configmaps", "persistentvolumeclaims", "namespaces"]
+    resources: ["pods", "pods/status", "services", "configmaps", "persistentvolumeclaims"]
     verbs: ["get", "delete", "create"]
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get"]
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/templates/stacks-devnet-api.template.yaml b/templates/stacks-devnet-api.template.yaml
@@ -11,9 +11,12 @@ metadata:
   name: stacks-devnet-api-service-account
 rules:
   - apiGroups: [""]
-    # TODO: production version should not be able to create/delete namespaces (only get) 
-    resources: ["pods", "pods/status", "services", "configmaps", "persistentvolumeclaims", "namespaces"]
+    resources: ["pods", "pods/status", "services", "configmaps", "persistentvolumeclaims"]
     verbs: ["get", "delete", "create"]
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get"]
+
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1