We should provide a kubectl plugin to find out the effective permissions of a Helm release.
KubePlus creates each application instance (Helm release) in a separate Namespace. The ServiceAccount with which this Helm release is running is scoped to this Namespace. While this provides some assurance of the runtime permissions that the Helm release is running with, it will be helpful to provide a kubectl plugin for this.
This should find out the ServiceAccount with which the underlying Helm release is running, and then query rolebinding/cluster rolebindings to find out what resources is this ServiceAccount a subject for.
We should provide a kubectl plugin to find out the effective permissions of a Helm release.
KubePlus creates each application instance (Helm release) in a separate Namespace. The ServiceAccount with which this Helm release is running is scoped to this Namespace. While this provides some assurance of the runtime permissions that the Helm release is running with, it will be helpful to provide a kubectl plugin for this.
kubectl showpermissions <Resource-Composition> <Resource-Instance>This should find out the ServiceAccount with which the underlying Helm release is running, and then query rolebinding/cluster rolebindings to find out what resources is this ServiceAccount a subject for.