mirror of
https://github.com/malarinv/iperf3-monitor.git
synced 2026-03-08 05:22:35 +00:00
Malar Kannan
d3cb92eb0f
* ci: Align Helm dependency setup in release workflow Adds missing Helm dependency setup steps (repo add, dependency build) to the release workflow, mirroring the CI workflow. This ensures that dependencies are correctly handled during linting and packaging in the release process. * refactor: Scope exporter RBAC to namespace for least privilege Changed the exporter's ClusterRole and ClusterRoleBinding to a namespaced Role and RoleBinding. This modification ensures that the exporter, by default, only has permissions to get, list, and watch pods within its own installation namespace. This aligns with the default behavior of IPERF_SERVER_NAMESPACE, which also defaults to the pod's own namespace, thereby adhering more strictly to the principle of least privilege. Verified with `helm template` that the Role and RoleBinding are correctly created within the release namespace. --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
36 lines
1.0 KiB
YAML
36 lines
1.0 KiB
YAML
{{- if .Values.rbac.create -}}
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: {{ include "iperf3-monitor.serviceAccountName" . }}
|
|
labels:
|
|
{{- include "iperf3-monitor.labels" . | nindent 4 }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ include "iperf3-monitor.fullname" . }}-role
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "iperf3-monitor.labels" . | nindent 4 }}
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ include "iperf3-monitor.fullname" . }}-rb
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "iperf3-monitor.labels" . | nindent 4 }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "iperf3-monitor.serviceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
roleRef:
|
|
kind: Role # Changed from ClusterRole
|
|
name: {{ include "iperf3-monitor.fullname" . }}-role
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end -}} |