wbsong111
09d0d4e59d
* chart_version_detector: repo가 이미 등록돼 있으면 update를 건너뛰던 버그를 고친다 repo alias가 이미 helm repo list에 있으면 add/update를 통째로 건너뛰어, 로컬에 예전에 캐시된 index.yaml을 그대로 썼다 — latest_version이 조용히 낡은 값으로 나온다(실측: secrets-operator에서 실제 최신 0.11.8 대신 0.11.4가 나왔다). repo 등록 여부와 무관하게 update는 항상 호출하도록 고친다. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * secrets-operator v0.10.33 → 0.11.8 호환성: breaking_change_check 결과 breaking=false(이 차트는 custom-values.yaml이 없어 오버라이드 충돌 자체가 불가능). CVE: infisical/kubernetes-operator 이미지를 trivy+CoverageProbe로 실측한 결과 실효 HIGH 차단이 34→10건으로 줄었다(CRITICAL은 둘 다 0, 둘 다 CoverageProbe: ok로 측정 신뢰 가능). 신규 CRD 3개 (InfisicalAuth·InfisicalConnection·InfisicalStaticSecret) 추가 — 상세는 CUSTOM-README.md. 기존 v0.10.33 디렉토리는 카탈로그 정책대로 동결 보관한다(삭제하지 않음). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * secrets-operator 자체 빌드 이미지 배포 테스트 오버라이드 추가 dev 클러스터에서 hardened-containers 자체 빌드 이미지(v0.11.8-security-hardened)로 실제 업그레이드·CRD 적용·Infisical 시크릿 동기화까지 검증할 때 쓴 오버라이드. 카탈로그 값(이 차트는 애초에 custom-values.yaml 없음)은 건드리지 않는다. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
153 lines
3.3 KiB
YAML
153 lines
3.3 KiB
YAML
{{- $namespaces := (include "secrets-operator.scopedNamespaces" . | fromJson).list }}
|
|
{{- $isScopedMode := and $namespaces .Values.scopedRBAC }}
|
|
|
|
{{- /* Define the rules once to avoid repetition */ -}}
|
|
{{- define "secrets-operator.managerRules" }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
- secrets
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- serviceaccounts
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- serviceaccounts/token
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- daemonsets
|
|
- deployments
|
|
- statefulsets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- authentication.k8s.io
|
|
resources:
|
|
- tokenreviews
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- secrets.infisical.com
|
|
resources:
|
|
- clustergenerators
|
|
- infisicalauths
|
|
- infisicalconnections
|
|
- infisicaldynamicsecrets
|
|
- infisicalpushsecrets
|
|
- infisicalsecrets
|
|
- infisicalstaticsecrets
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- secrets.infisical.com
|
|
resources:
|
|
- infisicalauths/status
|
|
- infisicalconnections/status
|
|
- infisicaldynamicsecrets/status
|
|
- infisicalpushsecrets/status
|
|
- infisicalsecrets/status
|
|
- infisicalstaticsecrets/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- secrets.infisical.com
|
|
resources:
|
|
- infisicaldynamicsecrets/finalizers
|
|
- infisicalpushsecrets/finalizers
|
|
- infisicalsecrets/finalizers
|
|
- infisicalstaticsecrets/finalizers
|
|
verbs:
|
|
- update
|
|
{{- end }}
|
|
|
|
{{- if $isScopedMode }}
|
|
{{- /* Scoped mode: Create a Role and RoleBinding in each namespace */ -}}
|
|
{{- range $ns := $namespaces }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ include "secrets-operator.fullname" $ }}-manager-role
|
|
namespace: {{ $ns | quote }}
|
|
labels:
|
|
{{- include "secrets-operator.labels" $ | nindent 4 }}
|
|
{{- include "secrets-operator.managerRules" $ }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ include "secrets-operator.fullname" $ }}-manager-rolebinding
|
|
namespace: {{ $ns | quote }}
|
|
labels:
|
|
{{- include "secrets-operator.labels" $ | nindent 4 }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ include "secrets-operator.fullname" $ }}-manager-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "secrets-operator.serviceAccountName" $ }}
|
|
namespace: {{ $.Release.Namespace }}
|
|
{{- end }}
|
|
{{- else }}
|
|
{{- /* Cluster-scoped mode: Create a ClusterRole and ClusterRoleBinding */ -}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ include "secrets-operator.fullname" . }}-manager-role
|
|
labels:
|
|
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
{{- include "secrets-operator.managerRules" . }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ include "secrets-operator.fullname" . }}-manager-rolebinding
|
|
labels:
|
|
{{- include "secrets-operator.labels" . | nindent 4 }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ include "secrets-operator.fullname" . }}-manager-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "secrets-operator.serviceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
{{- end }}
|