The current Conjur OSS Helm chart templates include the creation of both
a Kubernetes ClusterRole and a ClusterRoleBinding. The intent of the
ClusterRoleBinding is to grant RBAC permissions (across all namespaces) for
the Conjur's Kubernetes authenticator plugin (authn-k8s).
A better approach is to not use a ClusterRoleBinding (which applies across
all namespaces), and instead rely upon users to create namespace-scoped
RoleBindings for those namespaces that have applications that require
authn-k8s authentication.
This change adds deprecation warnings in the chart README.md and in
the charts values.yaml file indicating that the rbac.create chart
value is being deprecated and will be replace by 2 separate setting
in the next major release:
rbac.createClusterRole (defaulting to true)
rbac.createClusterRoleBinding (defaulting to false)
What ticket does this PR close?
Resolves #95
Checklists
Change log
[ ] The CHANGELOG has been updated, or
[x] This PR does not include user-facing changes and doesn't require a CHANGELOG update
Test coverage
[ ] This PR includes new unit and integration tests to go with the code changes, or
[x] The changes in this PR do not require tests
Documentation
[x] Docs (e.g. READMEs) were updated in this PR, and/or there is a follow-on issue to update docs, or
[ ] This PR does not require updating any documentation
What does this PR do?
The current Conjur OSS Helm chart templates include the creation of both a Kubernetes ClusterRole and a ClusterRoleBinding. The intent of the ClusterRoleBinding is to grant RBAC permissions (across all namespaces) for the Conjur's Kubernetes authenticator plugin (authn-k8s).
A better approach is to not use a ClusterRoleBinding (which applies across all namespaces), and instead rely upon users to create namespace-scoped RoleBindings for those namespaces that have applications that require authn-k8s authentication.
This change adds deprecation warnings in the chart README.md and in the charts values.yaml file indicating that the rbac.create chart value is being deprecated and will be replace by 2 separate setting in the next major release:
What ticket does this PR close?
Resolves #95
Checklists
Change log
Test coverage
Documentation
READMEs) were updated in this PR, and/or there is a follow-on issue to update docs, or