Restrict tigera-operator secret access to namespace only, retain get/…

…list/watch cluster-wide
projectcalico · Dec 5, 2024 · f09666d · f09666d
1 parent 35aca22
commit f09666d
Show file tree

Hide file tree

Showing 7 changed files with 100 additions and 3 deletions.
diff --git a/charts/tigera-operator/templates/tigera-operator/02-role-tigera-operator-secrets.yaml b/charts/tigera-operator/templates/tigera-operator/02-role-tigera-operator-secrets.yaml
@@ -0,0 +1,16 @@
+# Permissions required to manipulate operator secrets for a Calico cluster.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: tigera-operator-secrets
+  labels:
+    {{- include "tigera-operator.labels" (dict "context" .) | nindent 4 }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - update
+      - delete
diff --git a/charts/tigera-operator/templates/tigera-operator/02-role-tigera-operator.yaml b/charts/tigera-operator/templates/tigera-operator/02-role-tigera-operator.yaml
@@ -59,7 +59,6 @@ rules:
       - endpoints
       - events
       - configmaps
-      - secrets
       - serviceaccounts
     verbs:
       - create
@@ -72,6 +71,7 @@ rules:
       - ""
     resources:
       - resourcequotas
+      - secrets
     verbs:
       - list
       - get

diff --git a/charts/tigera-operator/templates/tigera-operator/02-rolebinding-tigera-operator-secrets.yaml b/charts/tigera-operator/templates/tigera-operator/02-rolebinding-tigera-operator-secrets.yaml
@@ -0,0 +1,15 @@
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: tigera-operator-secrets
+  namespace: {{.Release.Namespace}}
+  labels:
+    {{- include "tigera-operator.labels" (dict "context" .) | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{.Release.Namespace}}
+    namespace: {{.Release.Namespace}}
+roleRef:
+  kind: ClusterRole
+  name: tigera-operator-secrets
+  apiGroup: rbac.authorization.k8s.io
diff --git a/manifests/ocp/02-role-tigera-operator-secrets.yaml b/manifests/ocp/02-role-tigera-operator-secrets.yaml
diff --git a/manifests/ocp/02-role-tigera-operator.yaml b/manifests/ocp/02-role-tigera-operator.yaml
diff --git a/manifests/ocp/02-rolebinding-tigera-operator-secrets.yaml b/manifests/ocp/02-rolebinding-tigera-operator-secrets.yaml
diff --git a/manifests/tigera-operator.yaml b/manifests/tigera-operator.yaml