unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

operator RO creds: read operator CRD API groups #135

Merged
benvin merged 1 commits from benvin/operator-read-crds into master 2026-08-23 12:29:02 +10:00
Conversation 0 Commits 1 Files Changed 1
+22
unkin-agent commented 2026-08-23 12:27:20 +10:00
Member
Copy Link
Copy Source

Why

The operator kube context is a Vault-minted, read-only credential (Kubernetes
secret engine role cluster-operator, bound to a get/list/watch-only
ClusterRole). It is currently RBAC-forbidden from listing operator-owned CRDs —
the immediate breakage is valkeyclusters.valkey.io — and likewise every other
operator CRD group deployed via argocd-apps. This extends the RO ruleset so the
context can read those CRDs. Still strictly read-only: no create/update/delete.

Change

  • Extend the cluster-operator generated_role_rules
    (resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml)
    with get/list/watch on the CRD API groups of the operators deployed via
    argocd-apps (verbs and resources: "*" unchanged; same single rule block).

API groups added

  • valkey.io (valkey-operator — immediate need)
  • ceph.unkin.net (cephrgw-operator)
  • bind.unkin.net (bind-operator)
  • kea.unkin.net (kea/dhcp operator)
  • k8up.io (k8up)
  • grafana.integreatly.org (grafana-operator)
  • operator.victoriametrics.com (VictoriaMetrics operator)
  • clickhouse.altinity.com, clickhouse-keeper.altinity.com (altinity clickhouse-operator)
  • acme.cert-manager.io (cert-manager companion CRD group)
  • deviceplugin.intel.com, fpga.intel.com (intel device plugins operator)
  • autoscaling.k8s.io (VPA)
  • apm.k8s.elastic.co, beat.k8s.elastic.co, agent.k8s.elastic.co,
    maps.k8s.elastic.co, enterprisesearch.k8s.elastic.co,
    autoscaling.k8s.elastic.co, stackconfigpolicy.k8s.elastic.co (ECK — the
    elasticsearch/kibana/logstash ECK groups were already granted)
  • snapshot.storage.k8s.io, groupsnapshot.storage.k8s.io (CSI external-snapshotter, deployed via csi-cephfs/csi-cephrbd)

Groups already present (postgresql.cnpg.io, cert-manager.io,
externaldns.k8s.io, secrets.hashicorp.com, purelb.io, nfd.k8s-sigs.io,
elasticsearch/kibana/logstash.k8s.elastic.co, gateway.networking.k8s.io,
etc.) are unchanged. Rancher/RKE/Calico/cluster-api/fleet management-layer CRD
groups are intentionally excluded — they are not argocd-apps operators.

## Why The `operator` kube context is a Vault-minted, read-only credential (Kubernetes secret engine role `cluster-operator`, bound to a `get/list/watch`-only ClusterRole). It is currently RBAC-forbidden from listing operator-owned CRDs — the immediate breakage is `valkeyclusters.valkey.io` — and likewise every other operator CRD group deployed via `argocd-apps`. This extends the RO ruleset so the context can read those CRDs. Still strictly read-only: no create/update/delete. ## Change - Extend the `cluster-operator` generated_role_rules (`resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml`) with `get/list/watch` on the CRD API groups of the operators deployed via `argocd-apps` (verbs and `resources: "*"` unchanged; same single rule block). ## API groups added - `valkey.io` (valkey-operator — immediate need) - `ceph.unkin.net` (cephrgw-operator) - `bind.unkin.net` (bind-operator) - `kea.unkin.net` (kea/dhcp operator) - `k8up.io` (k8up) - `grafana.integreatly.org` (grafana-operator) - `operator.victoriametrics.com` (VictoriaMetrics operator) - `clickhouse.altinity.com`, `clickhouse-keeper.altinity.com` (altinity clickhouse-operator) - `acme.cert-manager.io` (cert-manager companion CRD group) - `deviceplugin.intel.com`, `fpga.intel.com` (intel device plugins operator) - `autoscaling.k8s.io` (VPA) - `apm.k8s.elastic.co`, `beat.k8s.elastic.co`, `agent.k8s.elastic.co`, `maps.k8s.elastic.co`, `enterprisesearch.k8s.elastic.co`, `autoscaling.k8s.elastic.co`, `stackconfigpolicy.k8s.elastic.co` (ECK — the `elasticsearch`/`kibana`/`logstash` ECK groups were already granted) - `snapshot.storage.k8s.io`, `groupsnapshot.storage.k8s.io` (CSI external-snapshotter, deployed via csi-cephfs/csi-cephrbd) Groups already present (`postgresql.cnpg.io`, `cert-manager.io`, `externaldns.k8s.io`, `secrets.hashicorp.com`, `purelb.io`, `nfd.k8s-sigs.io`, `elasticsearch/kibana/logstash.k8s.elastic.co`, `gateway.networking.k8s.io`, etc.) are unchanged. Rancher/RKE/Calico/cluster-api/fleet management-layer CRD groups are intentionally excluded — they are not `argocd-apps` operators.
unkin-agent added 1 commit 2026-08-23 12:27:20 +10:00
operator RO creds: read operator CRD API groups
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
8b7f7d61a0 
The operator kube context (Vault-minted cluster-operator creds) is a
read-only ClusterRole and is RBAC-forbidden from get/list/watch on
operator-owned CRDs such as valkeyclusters.valkey.io. Grant read on the
CRD API groups of the operators deployed via argocd-apps.
benvin merged commit 6c68057e73 into master 2026-08-23 12:29:02 +10:00
benvin deleted branch benvin/operator-read-crds 2026-08-23 12:29:03 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#135
Delete Branch "benvin/operator-read-crds"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?