search

kyma-project / kyma

Kyma is an opinionated set of Kubernetes-based modular building blocks, including all necessary capabilities to develop and run enterprise-grade cloud-native applications.
https://kyma-project.io
Apache License 2.0
1.51k stars 404 forks source link

Remove redundant secret migration code and RBAC objects in Compass Runtime Agent #17698

Closed koala7659 closed 4 months ago

koala7659 commented 1 year ago

Description

As part of https://github.com/kyma-project/kyma/issues/15915 we have recently updated Compass Runtime Agent service in Kyma to store the secret configuration data inside kyma-system namespace and stop using the old compass-system namespace for it.

To not affect existing runtimes some specialised code has been written to copy the content of old secrets from compass-system namespace into new desired location in secrets in kyma-system namespace. This migrator code required additional RBAC rules to access data inside multiple namespaces and configuration variables in Compass Runtime Agent deployment.

Used ClusterRoleBindings: 

    - apiGroups: [""]
      resources: ["secrets"]
      resourceNames: ["compass-agent-configuration","cluster-client-certificates"]
      verbs: ["get", "delete"]

After successful migration there is need to maintain old secret migrator code and keep too broad RBAC rules for Compass Runtime Agent service account.

Reason:

To secure Kyma Runtime we should limit the scope of privileges assigned for Kyma components. Removing secret migrator code and related RBAC objects will ensure Compass Runtime Agent cannot not access secrets in different namespaces.

Expected code change:

Related PRs:

kyma-bot commented 1 year ago

This issue or PR has been automatically marked as stale due to the lack of recent activity. Thank you for your contributions.

This bot triages issues and PRs according to the following rules:

You can:

If you think that I work incorrectly, kindly raise an issue with the problem.

/lifecycle stale

koala7659 commented 6 months ago

There is still a dependency to istio-system namespace. We must address it to avoid pod crashing without the namespace.

github-actions[bot] commented 4 months ago

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

github-actions[bot] commented 4 months ago

This issue has been automatically closed due to the lack of recent activity. /lifecycle rotten