Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improper k8s RBAC API Groups #373

Open
MattMolloyatHilti opened this issue Mar 25, 2024 · 0 comments
Open

Improper k8s RBAC API Groups #373

MattMolloyatHilti opened this issue Mar 25, 2024 · 0 comments

Comments

@MattMolloyatHilti
Copy link

In the authorization role that is set up in the template the rules section uses a single rule that applies across multiple api groups ("" and batch). This results in some invalid combinations like requesting "get" on "pods" in api group "batch".

Our build system uses a service account which isn't granted these invalid permissions and this causes the install of the helm chart to fail with log entries such as:

`... is attempting to grant RBAC permissions not currently held:

{APIGroups:[""], Resources:["jobs"], Verbs:["get" "list" "watch"]}
{APIGroups:["batch"], Resources:["pods"], Verbs:["get" "list" "watch"]}
{APIGroups:["batch"], Resources:["services"], Verbs:["get" "list" "watch"]}`

Please break this single rule into multiple rules so it will not result in invalid combinations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant