charts icon indicating copy to clipboard operation
charts copied to clipboard

fix: Replace wildcards in RBAC objects with explicit resources and verbs

Open legal90 opened this issue 5 months ago • 2 comments

According to Kubernetes documentation and various k8s security guidelines, wildcards in resource and verb entries should be avoided:

[!WARNING] Using wildcards in resource and verb entries could result in overly permissive access being granted to sensitive resources. For instance, if a new resource type is added, or a new subresource is added, or a new custom verb is checked, the wildcard entry automatically grants access, which may be undesirable. The principle of least privilege should be employed, using specific resources and verbs to ensure only the permissions required for the workload to function correctly are applied.

Refs:

  • https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding
  • https://cloud.google.com/kubernetes-engine/docs/best-practices/rbac#no-wildcards

This PR could be seen as a continuation of a previous work for hardening the RBAC: https://github.com/kedacore/charts/pull/625 It replaces * with explicit verbs and resources, according to KEDA needs.

Checklist

  • [x] I have verified that my change is according to the deprecations & breaking changes policy
  • [x] Commits are signed with Developer Certificate of Origin (DCO - learn more)
  • [x] README is updated with new configuration values (if applicable) learn more
  • [x] A PR is opened to update KEDA core (repo) (if applicable, ie. when deployment manifests are modified)

Similar PR to the main keda repo: https://github.com/kedacore/keda/pull/6129

legal90 avatar Sep 02 '24 15:09 legal90