unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings #332

Merged
benvin merged 1 commits from benvin/agent-dns-rbac into main 2026-08-02 21:49:38 +10:00
Conversation 0 Commits 1 Files Changed 8
+90

1 Commits

Author SHA1 Message Date
Ben Vincent 65344d2523 Add agent-dns RBAC: static SA + ClusterRole + per-namespace RoleBindings
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details 
Vault's kubernetes secret engine will mint scoped tokens for a static
service account instead of generating cluster-wide RBAC, so agent DNS
access is confined to exactly the bind namespaces. This is the GitOps
half of the terraform-vault agent-dns role rework; it must sync before
the Vault agent-dns creds are usable (Vault mints tokens for an SA that
must already exist).

- add ServiceAccount agent-dns + ClusterRole agent-dns (definition only,
  no ClusterRoleBinding) in bind-system: full verbs on bind.unkin.net
  CRDs, get/list/watch pods/services/configmaps/events, get pods/log.
- add RoleBinding agent-dns in bind-system, bind-internal, bind-external,
  externaldns, each binding the SA to the ClusterRole in that namespace.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
 2026-08-02 21:41:32 +10:00