Skip to content

Commit caaf4f9

Browse files
committed
fix(dashboard): restrict RBAC to cluster-scoped resources and cleanup naming
Remove namespace-scoped resources (tenantsecrets, tenantnamespaces, tenantmodules, virtualmachineinstances, virtualmachineinstances/vnc) from the cozystack-dashboard-readonly ClusterRole bound to system:authenticated. These resources must be accessed via per-namespace RoleBindings created by the tenant operator, not through a cluster-wide grant to all authenticated users. Only truly cluster-scoped, public-by-design resources remain in the ClusterRole: applicationdefinitions, storageclasses, backupclasses, and dashboard.cozystack.io customization resources. Also rename the leftover incloud-web-web-user-edit ClusterRoleBinding to cozystack-dashboard-cluster-admin to match the new naming convention, and declare Makefile targets as .PHONY. Signed-off-by: IvanHunters <[email protected]>
1 parent e8fbd4e commit caaf4f9

3 files changed

Lines changed: 3 additions & 25 deletions

File tree

‎packages/system/dashboard/Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ export NAMESPACE=cozy-$(NAME)
44
include ../../../hack/common-envs.mk
55
include ../../../hack/package.mk
66

7+
.PHONY: image image-console image-token-proxy
8+
79
image: image-console image-token-proxy
810

911
CONSOLE_REPO ?= https://github.com/cozystack/cozystack-ui.git

‎packages/system/dashboard/templates/clusterrolebinding-web-user-edit.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRoleBinding
33
metadata:
44
annotations: {}
5-
name: incloud-web-web-user-edit
5+
name: cozystack-dashboard-cluster-admin
66
roleRef:
77
apiGroup: rbac.authorization.k8s.io
88
kind: ClusterRole

‎packages/system/dashboard/templates/rbac.yaml‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,6 @@ rules:
1212
- get
1313
- list
1414
- watch
15-
- apiGroups:
16-
- core.cozystack.io
17-
resources:
18-
- tenantmodules
19-
- tenantnamespaces
20-
- tenantsecrets
21-
verbs:
22-
- get
23-
- list
24-
- watch
2515
- apiGroups:
2616
- dashboard.cozystack.io
2717
resources:
@@ -46,20 +36,6 @@ rules:
4636
- get
4737
- list
4838
- watch
49-
- apiGroups:
50-
- kubevirt.io
51-
resources:
52-
- virtualmachineinstances
53-
verbs:
54-
- get
55-
- list
56-
- watch
57-
- apiGroups:
58-
- subresources.kubevirt.io
59-
resources:
60-
- virtualmachineinstances/vnc
61-
verbs:
62-
- get
6339
---
6440
apiVersion: rbac.authorization.k8s.io/v1
6541
kind: ClusterRoleBinding

0 commit comments

Comments
 (0)