From 82fc4a9f8c73d58da8d41b824a54f7b3fc5e0d29 Mon Sep 17 00:00:00 2001 From: Ved Ratan Date: Wed, 9 Oct 2024 17:37:29 +0530 Subject: [PATCH 1/2] fix: tuned the permissions to reduce wildcard perms by default Signed-off-by: Ved Ratan --- charts/cluster-registrator/templates/job.yaml | 166 +++++++++++++----- charts/cluster-registrator/values.yaml | 7 + 2 files changed, 132 insertions(+), 41 deletions(-) diff --git a/charts/cluster-registrator/templates/job.yaml b/charts/cluster-registrator/templates/job.yaml index a83a2bf9..7591a4a3 100644 --- a/charts/cluster-registrator/templates/job.yaml +++ b/charts/cluster-registrator/templates/job.yaml @@ -30,8 +30,9 @@ rules: - clusterrolebindings - clusterroles verbs: - - escalate - - bind +{{- if or (eq .Values.controllerPerms "read-write-ndp") (eq .Values.controllerPerms "admin") (eq .Values.controllerPerms "read-write") }} +{{ toYaml .Values.privilegePerms | indent 6 }} +{{- end }} - create {{- if eq .Values.controllerPerms "read-write-ndp" }} - apiGroups: @@ -236,7 +237,28 @@ rules: - operator.kyverno.io - kyverno.io resources: - - '*' + - policies + - policies/status + - clusterpolicies + - clusterpolicies/status + - policyexceptions + - cleanuppolicies + - clustercleanuppolicies + - generaterequests + - generaterequests/status + - reportchangerequests + - reportchangerequests/status + - clusterreportchangerequests + - clusterreportchangerequests/status + - kyvernooperators/status + - kyvernooperators + - imagekeys + - imagekeys/status + - imagekeys/finalizers + - kyvernoes + - kyvernoes/status + - kyvernoconfigs + - kyvernoconfigs/status verbs: - get - list @@ -253,54 +275,43 @@ rules: - security.nirmata.io resources: - policies + - policies/status - clusterpolicies + - clusterpolicies/status + - policyexceptions - cleanuppolicies - clustercleanuppolicies - - kyvernoes - - kyvernoes/status - - policyexceptions + - generaterequests + - generaterequests/status - reportchangerequests + - reportchangerequests/status - clusterreportchangerequests + - clusterreportchangerequests/status - kyvernooperators/status - kyvernooperators - imagekeys - imagekeys/status - imagekeys/finalizers + - kyvernoes + - kyvernoes/status + - kyvernoconfigs + - kyvernoconfigs/status verbs: - - get - - watch - - list + - 'get' + - 'watch' + - 'list' - apiGroups: - wgpolicyk8s.io/v1alpha1 - wgpolicyk8s.io/v1alpha2 resources: - policyreports - - clusterpolicyreports - verbs: - - get - - watch - - list -- apiGroups: - - '*' - resources: - - policies - - policies/status - - clusterpolicies - - clusterpolicies/status - - policyreports - policyreports/status - clusterpolicyreports - clusterpolicyreports/status - - generaterequests - - generaterequests/status - - reportchangerequests - - reportchangerequests/status - - clusterreportchangerequests - - clusterreportchangerequests/status verbs: - - get - - list - - watch + - 'get' + - 'watch' + - 'list' - apiGroups: - apiextensions.k8s.io resources: @@ -310,13 +321,12 @@ rules: - list - watch - apiGroups: - - '*' + - '' resources: - nodes - pods - pods/log - namespaces - - networkpolicies - secrets - configmaps - resourcequotas @@ -324,31 +334,103 @@ rules: - deployments - services - serviceaccounts + - componentstatuses + - endpoints + - persistentvolumes + - replicasets + - statefulsets + - daemonsets + verbs: + - list + - get + - watch +- apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - get + - list + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: - roles - rolebindings - clusterroles - clusterrolebindings + verbs: + - get + - list + - watch +- apiGroups: + - '' + - events.k8s.io + resources: - events + verbs: + - get + - list + - watch +- apiGroups: + - admissionregistration.k8s.io + resources: - mutatingwebhookconfigurations - validatingwebhookconfigurations + verbs: + - get + - list + - watch +- apiGroups: + - certificates.k8s.io + resources: - certificatesigningrequests - certificatesigningrequests/approval + verbs: + - get + - list + - watch +- apiGroups: + - policy + resources: - poddisruptionbudgets - - componentstatuses - - endpoints + - podsecuritypolicies + verbs: + - get + - list + - watch +- apiGroups: + - storage.k8s.io + resources: - storageclasses + verbs: + - get + - list + - watch +- apiGroups: + - scheduling.k8s.io + resources: - priorityclasses - - clusterissuers - - podsecuritypolicies - - persistentvolumes - - replicasets + verbs: + - get + - list + - watch +- apiGroups: + - batch + resources: - cronjobs - - daemonsets - jobs - - statefulsets verbs: + - get - list + - watch +- apiGroups: + - cert-manager.io + resources: + - clusterissuers + verbs: - get + - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 @@ -442,6 +524,8 @@ spec: value: "{{ .Values.tlsCert }}" - name: APIKEY_SECRET_NAMESPACE value: "{{ .Release.Namespace }}" + - name: READ_ONLY + value: "{{ .Values.kubeController.isReadOnly }}" securityContext: allowPrivilegeEscalation: false capabilities: diff --git a/charts/cluster-registrator/values.yaml b/charts/cluster-registrator/values.yaml index 30a88558..90b1f83f 100644 --- a/charts/cluster-registrator/values.yaml +++ b/charts/cluster-registrator/values.yaml @@ -9,6 +9,9 @@ cluster: name: type: "default-policy-manager-type" +kubeController: + isReadOnly: true + apiToken: proxy: @@ -29,4 +32,8 @@ imageTag: v0.1.4 # variations such as: * on polexes but read-only on policy-reports, etc. controllerPerms: 'read-write' +privilegePerms: +- escalate +- bind + namespace: nirmata From c80b75b103563de813e0a920e7097b3575ff56d4 Mon Sep 17 00:00:00 2001 From: Ved Ratan Date: Wed, 9 Oct 2024 17:39:28 +0530 Subject: [PATCH 2/2] bump: chart version Signed-off-by: Ved Ratan --- charts/cluster-registrator/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/cluster-registrator/Chart.yaml b/charts/cluster-registrator/Chart.yaml index 0295d722..b9fe27b1 100644 --- a/charts/cluster-registrator/Chart.yaml +++ b/charts/cluster-registrator/Chart.yaml @@ -15,7 +15,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.15 +version: 0.1.16-rc1 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to