mittwald/kubernetes-replicator

Wrong ClusterRole privileges when using Helm

gcaracuel opened this issue · 3 comments

Describe the bug
When using Helm deploy method te RBAC configuration does introduce not needed privileges, some of them are dangerous and reported as not recommended at NSA Kubernetes hardening guidance

To Reproduce
When using Helm deploy method ClusterRole templated differs from https://github.com/mittwald/kubernetes-replicator/blob/master/deploy/rbac.yaml

Expected behavior
At ClusterRole:

- apiGroups: [""] # "" indicates the core API group
  resources: ["secrets", "configmaps"]
  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]

Instead of:

  - apiGroups: 
      - ""
      - apps
      - extensions
    resources: 
      - secrets
      - configmaps
      - roles
      - rolebindings
      - cronjobs
      - deployments
      - events
      - ingresses
      - jobs
      - pods
      - pods/attach
      - pods/exec
      - pods/log
      - pods/portforward
      - services
    verbs: ["get", "watch", "list", "create", "update", "patch", "delete", "describe"]
  - apiGroups: 
      - batch
    resources: 
      - configmaps
      - cronjobs
      - deployments
      - events
      - ingresses
      - jobs
      - pods
      - pods/attach
      - pods/exec
      - pods/log
      - pods/portforward
      - services
    verbs: ["get", "watch", "list", "create", "update", "patch", "delete", "describe"]

Environment:

  • Kubernetes version: Any
  • kubernetes-replicator version: v2.6.0 to current

Additional context
This issue was introduced by: #75
I guess the problem here is somebody used the example ClusterRole in the issue related this PR to create the replicator related ClusterRole which 2 totally different things.

There has not been any activity to this issue in the last 14 days. It will automatically be closed after 7 more days. Remove the stale label to prevent this.

Apologies. This issue should not have been closed.