simple_psat: No longer need RBAC configuration for Agent
hiyosi opened this issue · 4 comments
Later than spiffe/spire#922, SPIRE Agent no longer calls K8s API in the PSAT Node Attestor Plugin.
Therefore, I think we don't need ClusterRole and ClusterRoleBinding for SPIRE Agent.
But, If we use the Workload Registrar, the RBAC configuration like above is required?
Hi @hiyosi! After a little bit of testing, I found out that node attestation using PSAT Node Attestor Plugin keeps working well after agent's ClusterRole and ClusterRoleBinding deletion, but that isn't true for workload attestation. Using k8s WorkloadAttestor, I couldn't properly attest a workload, and I think that's mainly because of the need for pod information when the attestation is attempted (something that the role allows to). Following this reasoning, and though node attestation can work without the agent's ClusterRole and ClusterRoleBinding, my opinion is that we should leave the example as it is.
What do you think about it? Is there something that I'm missing in my reasoning? If so, please let me know
@lucianozablocki Thanks for testing. You are right!
Perhaps I l didn't care of the Workload Attestor.
I'll close this issue. thanks!