From 6b0402ff8b6bef04941b57818fac8ad483b997d3 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 21 Aug 2026 01:43:37 +0200 Subject: [PATCH] Add narrow ingress-read RBAC for management-platform-sa in default ns Odoo's and Nextcloud's Ingress objects live in the default namespace (historical, from the original Docker->k8s migration) rather than their own app namespace like n8n/mautic/erpnext. management-platform-sa had no binding there at all. Granting the full backup ClusterRole in default would be way too broad (default also hosts unrelated live services, and that role includes secrets/pod writes) - so this adds a separate ClusterRole scoped to just ingresses get/list/watch, bound only in default. Needed for the Application Sites page fix (next commit) to read real domain/TLS state instead of guessing. Applied and verified live: can read ingresses in default, still denied secrets/pod-delete there. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_017avLHFqkiti3g62Anq9sVA --- management-platform-sites-rbac.yaml | 32 +++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 management-platform-sites-rbac.yaml diff --git a/management-platform-sites-rbac.yaml b/management-platform-sites-rbac.yaml new file mode 100644 index 0000000..c2f48b6 --- /dev/null +++ b/management-platform-sites-rbac.yaml @@ -0,0 +1,32 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: management-platform-ingress-reader-role + labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration} +rules: + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get", "list", "watch"] +--- +# Odoo's and Nextcloud's Ingress objects live in the `default` namespace +# (historical — created there during the original Docker->k8s migration, +# unlike n8n/mautic/erpnext whose Ingress lives in their own app namespace). +# management-platform-sa has no binding at all in `default` otherwise, and +# `default` also hosts unrelated live services (cloudops-ingress, jenkins- +# ingress, stage-navitrends-ingress, etc.) — so this grants ONLY ingress +# read there, not the full backup ClusterRole, to keep blast radius to +# exactly what the Application Sites page needs (real domain/TLS lookup). +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: management-platform-ingress-reader-binding + namespace: default + labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: management-platform-ingress-reader-role +subjects: + - kind: ServiceAccount + name: management-platform-sa + namespace: management-platform