Skip to content

feat(helm): Offer the possiblity to disable aggreate-to-view and aggregate-to-edit on default ClusterRoles#4733

Merged
Skarlso merged 2 commits intoexternal-secrets:mainfrom
linolayani:aggreateToDefaultClusterRole
May 7, 2025
Merged

feat(helm): Offer the possiblity to disable aggreate-to-view and aggregate-to-edit on default ClusterRoles#4733
Skarlso merged 2 commits intoexternal-secrets:mainfrom
linolayani:aggreateToDefaultClusterRole

Conversation

@linolayani
Copy link
Copy Markdown
Contributor

@linolayani linolayani commented May 2, 2025

Problem Statement

View and edit permissions are aggregated to the view and edit default ClusterRoles.
Clusters admins would like to have the possiblity to disable this functionnality, so they can attach the default edit ClusterRole to a user, while blocking him from modifying an ExternalSecret

Related Issue

Fixes #4159

Proposed Changes

Adding the aggregateToView and aggregateToEdit booleans under the rbac object

Checklist

  • I have read the contribution guidelines
  • All commits are signed with git commit --signoff
  • My changes have reasonable test coverage
  • All tests pass with make test
  • I ensured my PR is ready for review with make reviewable

@linolayani
Allow for toggling aggregate-to-view and aggregate-to-edit
fb89fe9 
Signed-off-by: Lino Layani <layanilino@gmail.com>
@linolayani linolayani requested a review from a team as a code owner May 2, 2025 19:39
@linolayani linolayani requested a review from knelasevero May 2, 2025 19:39
@Skarlso
Copy link
Copy Markdown
Contributor

Skarlso commented May 6, 2025

You likely have to run make helm.test.update. I expect it to fail hopefully.

@linolayani
Copy link
Copy Markdown
Contributor Author

linolayani commented May 6, 2025 •
edited
Loading

Hi @Skarlso, I ran make.helm.test.update, and it passed. That's the command I've been using to verify that my tests are correct.
What makes you hope it fails ? 🤔

@Skarlso
Copy link
Copy Markdown
Contributor

Skarlso commented May 7, 2025

What makes you hope it fails ?

I hoped it would show that there is a change in the values.yaml. :D

It's okay. :)

@Skarlso
Copy link
Copy Markdown
Contributor

Skarlso commented May 7, 2025

/ok-to-test sha=fb89fe9c1e45e7c5206652afd5c1ea01f7c3f665

@eso-service-account-app
Copy link
Copy Markdown
Contributor

eso-service-account-app bot commented May 7, 2025

[Bot] - ✅ e2e for fb89fe9c1e45e7c5206652afd5c1ea01f7c3f665 passed

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented May 7, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@Skarlso Skarlso merged commit 62649b0 into external-secrets:main May 7, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Skarlso Skarlso Skarlso approved these changes

@knelasevero knelasevero Awaiting requested review from knelasevero knelasevero was automatically assigned from external-secrets/maintainers

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Unable aggregate cluster roles

2 participants

@linolayani @Skarlso