chart/helm: stricter default rbac for secrets (bank-vaults#1299)

Signed-off-by: Nandor Kracser <[email protected]>
rtnpro · Apr 21, 2021 · 53abecd · 53abecd
1 parent 1081a3b
commit 53abecd
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/charts/vault/Chart.yaml b/charts/vault/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: vault
-version: 1.11.8
+version: 1.11.9
 appVersion: 1.11.3
 description: A Helm chart for Vault, a tool for managing secrets
 home: https://www.vaultproject.io/

diff --git a/charts/vault/templates/role.yaml b/charts/vault/templates/role.yaml
@@ -12,7 +12,12 @@ metadata:
 rules:
 - apiGroups: [""]
   resources: ["secrets"]
+  resourceNames: ["bank-vaults"]
   verbs: ["*"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: [""]
+  verbs: ["create"]
 {{- end }}
 {{- if .Values.rbac.psp.enabled }}
 - apiGroups: ["extensions"]