charts
charts copied to clipboard
fix: Replace wildcards in RBAC objects with explicit resources and verbs
According to Kubernetes documentation and various k8s security guidelines, wildcards in resource and verb entries should be avoided:
[!WARNING] Using wildcards in resource and verb entries could result in overly permissive access being granted to sensitive resources. For instance, if a new resource type is added, or a new subresource is added, or a new custom verb is checked, the wildcard entry automatically grants access, which may be undesirable. The principle of least privilege should be employed, using specific resources and verbs to ensure only the permissions required for the workload to function correctly are applied.
Refs:
- https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding
- https://cloud.google.com/kubernetes-engine/docs/best-practices/rbac#no-wildcards
This PR could be seen as a continuation of a previous work for hardening the RBAC: https://github.com/kedacore/charts/pull/625
It replaces *
with explicit verbs and resources, according to KEDA needs.
Checklist
- [x] I have verified that my change is according to the deprecations & breaking changes policy
- [x] Commits are signed with Developer Certificate of Origin (DCO - learn more)
- [x] README is updated with new configuration values (if applicable) learn more
- [x] A PR is opened to update KEDA core (repo) (if applicable, ie. when deployment manifests are modified)
Similar PR to the main keda repo: https://github.com/kedacore/keda/pull/6129