Repository navigation
Commit caaf4f9
committed
fix(dashboard): restrict RBAC to cluster-scoped resources and cleanup naming
Remove namespace-scoped resources (tenantsecrets, tenantnamespaces,
tenantmodules, virtualmachineinstances, virtualmachineinstances/vnc) from
the cozystack-dashboard-readonly ClusterRole bound to system:authenticated.
These resources must be accessed via per-namespace RoleBindings created by
the tenant operator, not through a cluster-wide grant to all authenticated
users.
Only truly cluster-scoped, public-by-design resources remain in the
ClusterRole: applicationdefinitions, storageclasses, backupclasses,
and dashboard.cozystack.io customization resources.
Also rename the leftover incloud-web-web-user-edit ClusterRoleBinding to
cozystack-dashboard-cluster-admin to match the new naming convention, and
declare Makefile targets as .PHONY.
Signed-off-by: IvanHunters <[email protected]>1 parent e8fbd4e commit caaf4f9
3 files changed
Lines changed: 3 additions & 25 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| 7 | + | |
| 8 | + | |
7 | 9 | | |
8 | 10 | | |
9 | 11 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
5 | | - | |
| 5 | + | |
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
12 | 12 | | |
13 | 13 | | |
14 | 14 | | |
15 | | - | |
16 | | - | |
17 | | - | |
18 | | - | |
19 | | - | |
20 | | - | |
21 | | - | |
22 | | - | |
23 | | - | |
24 | | - | |
25 | 15 | | |
26 | 16 | | |
27 | 17 | | |
| |||
46 | 36 | | |
47 | 37 | | |
48 | 38 | | |
49 | | - | |
50 | | - | |
51 | | - | |
52 | | - | |
53 | | - | |
54 | | - | |
55 | | - | |
56 | | - | |
57 | | - | |
58 | | - | |
59 | | - | |
60 | | - | |
61 | | - | |
62 | | - | |
63 | 39 | | |
64 | 40 | | |
65 | 41 | | |
| |||
0 commit comments