UNCLASSIFIED - NO CUI

Skip to content

Follow-up from "Resolve "Test and Document Dev User RBAC""

The following discussion from !68 (merged) should be addressed:

  • @andrewshoell started a discussion: (+3 comments)

    When I run helm template chart --set "bigbang.rbac.enabled=true" I get invalid templates, e.g.

    ---
    # Source: headlamp/templates/bigbang/dev-clusterrolebinding.yaml
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: read-1
    rules:
      - apiGroups:
        - ""
        resources:
        - namespaces
        - pods
        verbs:
        - get
        - list
        - watch
    ---
    # Source: headlamp/templates/bigbang/dev-clusterrolebinding.yaml
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: -binding
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: 
    subjects:
    - kind: ServiceAccount
      name: release-name
      namespace: default
    ---

    Further see the following:

    helm template chart --set "bigbang.rbac.enabled=true" | kubectl apply --dry-run=server -f -
    
    serviceaccount/release-name-headlamp created (server dry run)
    secret/oidc created (server dry run)
    clusterrole.rbac.authorization.k8s.io/read-1 created (server dry run)
    service/release-name-headlamp created (server dry run)
    deployment.apps/release-name-headlamp created (server dry run)
    serviceaccount/headlamp-wait-job-sa created (server dry run)
    configmap/headlamp-wait-script created (server dry run)
    role.rbac.authorization.k8s.io/headlamp-wait-job-role created (server dry run)
    rolebinding.rbac.authorization.k8s.io/headlamp-wait-job-rolebinding created (server dry run)
    job.batch/headlamp-wait-job created (server dry run)
    The ClusterRoleBinding "-binding" is invalid: roleRef.name: Required value

We should turn on and test rbac with some combination of test-values.yaml, gluon script, cypress, and/or helm unit tests.