From 8b7f7d61a01cb50c7bacb1f1accdd1e2086d3d6b Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 23 Aug 2026 12:26:36 +1000 Subject: [PATCH] operator RO creds: read operator CRD API groups The operator kube context (Vault-minted cluster-operator creds) is a read-only ClusterRole and is RBAC-forbidden from get/list/watch on operator-owned CRDs such as valkeyclusters.valkey.io. Grant read on the CRD API groups of the operators deployed via argocd-apps. --- .../au/syd1/roles/cluster-operator.yaml | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml index f42fc8b..ddda80b 100644 --- a/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml +++ b/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml @@ -22,6 +22,28 @@ rules: - "elasticsearch.k8s.elastic.co" - "kibana.k8s.elastic.co" - "gateway.networking.k8s.io" + - "apm.k8s.elastic.co" + - "beat.k8s.elastic.co" + - "agent.k8s.elastic.co" + - "maps.k8s.elastic.co" + - "enterprisesearch.k8s.elastic.co" + - "autoscaling.k8s.elastic.co" + - "stackconfigpolicy.k8s.elastic.co" + - "valkey.io" + - "ceph.unkin.net" + - "bind.unkin.net" + - "kea.unkin.net" + - "k8up.io" + - "grafana.integreatly.org" + - "operator.victoriametrics.com" + - "clickhouse.altinity.com" + - "clickhouse-keeper.altinity.com" + - "acme.cert-manager.io" + - "deviceplugin.intel.com" + - "fpga.intel.com" + - "autoscaling.k8s.io" + - "snapshot.storage.k8s.io" + - "groupsnapshot.storage.k8s.io" resources: - "*" verbs: -- 2.47.3