From 5d2641cdd305b9acda86f31a620feed063111c0b Mon Sep 17 00:00:00 2001 From: Kjeld Schouten Date: Sat, 26 Oct 2024 23:49:03 +0200 Subject: [PATCH] chore(traefik): increase RBAC scope --- charts/premium/traefik/Chart.yaml | 2 +- charts/premium/traefik/values.yaml | 333 +++++++++++++++++++++++++---- 2 files changed, 295 insertions(+), 40 deletions(-) diff --git a/charts/premium/traefik/Chart.yaml b/charts/premium/traefik/Chart.yaml index e43f8dadd64..73aeafdbb8e 100644 --- a/charts/premium/traefik/Chart.yaml +++ b/charts/premium/traefik/Chart.yaml @@ -35,4 +35,4 @@ sources: - https://github.com/truecharts/containers/tree/master/apps/traefik - https://traefik.io/ type: application -version: 29.3.2 +version: 29.3.3 diff --git a/charts/premium/traefik/values.yaml b/charts/premium/traefik/values.yaml index 0fa93950479..b5432b3d85c 100644 --- a/charts/premium/traefik/values.yaml +++ b/charts/premium/traefik/values.yaml @@ -274,44 +274,7 @@ rbac: - apiGroups: - "" resources: - - services - - endpoints - - secrets - verbs: - - get - - list - - watch - - apiGroups: - - extensions - - networking.k8s.io - resources: - - ingresses - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - extensions - - networking.k8s.io - resources: - - ingresses/status - verbs: - - update - - apiGroups: - - traefik.containo.us - - traefik.io - resources: - - middlewares - - middlewaretcps - - ingressroutes - - traefikservices - - ingressroutetcps - - ingressrouteudps - - tlsoptions - - tlsstores - - serverstransports - - serverstransporttcps + - nodes verbs: - get - list @@ -319,7 +282,8 @@ rbac: - apiGroups: - "" resources: - - nodes + - endpoints + - services verbs: - get - list @@ -332,6 +296,297 @@ rbac: - get - list - watch + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - update + - create + - delete + - deletecollection + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingressclasses + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - traefik.io + resources: + - ingressroutes + - ingressroutetcps + - ingressrouteudps + - middlewares + - middlewaretcps + - serverstransports + - serverstransporttcps + - tlsoptions + - tlsstores + - traefikservices + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + - endpoints + - secrets + - services + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - apiGroups: + - gateway.networking.k8s.io + resources: + - backendtlspolicies + - gatewayclasses + - gateways + - grpcroutes + - httproutes + - referencegrants + - tcproutes + - tlsroutes + verbs: + - get + - list + - watch + - apiGroups: + - gateway.networking.k8s.io + resources: + - backendtlspolicies/status + - gatewayclasses/status + - gateways/status + - grpcroutes/status + - httproutes/status + - tcproutes/status + - tlsroutes/status + verbs: + - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - endpoints + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + - pods + verbs: + - get + - list + - watch + - apiGroups: + - hub.traefik.io + resources: + - accesscontrolpolicies + - apiaccesses + - apiportals + - apiratelimits + - apis + - apiversions + - apibundles + - apiplans + verbs: + - list + - watch + - create + - update + - patch + - delete + - get + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - endpoints + - services + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - traefik.io + resources: + - ingressroutes + - ingressroutetcps + - ingressrouteudps + - middlewares + - middlewaretcps + - tlsoptions + - tlsstores + - traefikservices + - serverstransports + - serverstransporttcps + verbs: + - get + - list + - watch + - apiGroups: + - extensions + resources: + - podsecuritypolicies + verbs: + - use + - apiGroups: + - "" + resources: + - services + - endpoints + - namespaces + - pods + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + # -- The service account the pods will use to interact with the Kubernetes API serviceAccount: main: