Skip to content

Commit 83e98d2

Browse files
jcoscollanrjcoscollanr
authored
Merge branch 'master' into feat/metadata-agent-control
2 parents db187d8 + 62e98b1 commit 83e98d2

File tree

2 files changed

+284
-5
lines changed

2 files changed

+284
-5
lines changed

‎charts/agent-control-bootstrap/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: agent-control-bootstrap
33
description: Bootstraps New Relic' Agent Control
44

55
type: application
6-
version: 1.6.0
6+
version: 1.7.0
77
# agent-control-deployment chart default version.
88
appVersion: 1.6.0
99
annotations:

‎charts/agent-control-bootstrap/templates/rbac-cd.yaml‎

Lines changed: 283 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,60 @@
11
{{- if .Values.agentControlCd.enabled }}
22
apiVersion: rbac.authorization.k8s.io/v1
3-
kind: ClusterRoleBinding
3+
kind: ClusterRole
4+
metadata:
5+
annotations:
6+
helm.sh/hook: post-install,post-upgrade
7+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
8+
helm.sh/hook-weight: "10"
9+
labels:
10+
{{- include "newrelic.common.labels" . | nindent 4 }}
11+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-install-job") }}
12+
rules:
13+
# Namespaces - Required to create Flux namespace and agents namespace
14+
- apiGroups: [ "" ]
15+
resources: [ namespaces ]
16+
verbs: [ get, list, create, patch, update ]
17+
18+
# CRDs - Required to install Flux CRDs
19+
# Note: 'delete' removed as installation job only creates/updates CRDs, never deletes them.
20+
# Uninstall job has separate permissions for deletion.
21+
- apiGroups: [ apiextensions.k8s.io ]
22+
resources: [ customresourcedefinitions ]
23+
verbs: [ get, list, create, update, patch ]
24+
25+
# Flux Resources - Required for Agent Control to create HelmRepository and HelmRelease
26+
# Note: Only helmrepositories and helmreleases are needed. The installation job creates these
27+
# resources via newrelic-agent-control-cli (create-cd-resources and install-agent-control commands).
28+
# Other Flux resources (helmcharts, gitrepositories, kustomizations, etc.) are not used by Agent Control.
29+
# 'delete' removed as installation job only creates/updates these resources, never deletes them.
30+
# Uninstall job has separate permissions for deletion.
31+
- apiGroups:
32+
- source.toolkit.fluxcd.io
33+
- helm.toolkit.fluxcd.io
34+
resources:
35+
- helmrepositories
36+
- helmreleases
37+
verbs: [ get, list, watch, create, update, patch ]
38+
39+
# RBAC - Required to create ClusterRoles for Flux controllers
40+
# Security Note: The 'bind' and 'escalate' verbs are required for bootstrapping Flux.
41+
# These permissions allow the installation job to create ClusterRoles and ClusterRoleBindings
42+
# for Flux controllers (helm-controller, source-controller) when installing the agent-control-cd
43+
# chart via 'helm install'. This is a known security trade-off in Kubernetes bootstrapping scenarios.
44+
# Mitigation: This job is temporary (deleted after success via hook-delete-policy: hook-succeeded)
45+
# and only runs during post-install/post-upgrade hooks, minimizing the attack surface.
46+
# Reference: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping
47+
# Note: 'delete' removed as installation job only creates/updates RBAC, never deletes.
48+
# Uninstall job has separate permissions for deletion.
49+
- apiGroups: [ rbac.authorization.k8s.io ]
50+
resources:
51+
- clusterroles
52+
- clusterrolebindings
53+
verbs: [ get, list, create, update, patch, bind, escalate ]
54+
55+
---
56+
apiVersion: rbac.authorization.k8s.io/v1
57+
kind: Role
458
metadata:
559
annotations:
660
helm.sh/hook: post-install,post-upgrade
@@ -10,17 +64,158 @@ metadata:
1064
{{- include "newrelic.common.labels" . | nindent 4 }}
1165
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-install-job") }}
1266
namespace: {{ .Release.Namespace }}
67+
rules:
68+
# Secrets - Required for Flux and Agent Control to store credentials
69+
# Keeping get, list, watch as Flux needs to check if secrets exist before creating
70+
- apiGroups: [ "" ]
71+
resources: [ secrets ]
72+
verbs: [ get, list, watch, create, update, patch, delete ]
73+
74+
# ConfigMaps - Required for Flux and Agent Control configuration
75+
- apiGroups: [ "" ]
76+
resources: [ configmaps ]
77+
verbs: [ get, list, watch, create, update, patch, delete ]
78+
79+
# ServiceAccounts - Required to create Flux controller service accounts
80+
- apiGroups: [ "" ]
81+
resources: [ serviceaccounts ]
82+
verbs: [ get, list, create, update, patch, delete ]
83+
84+
# RBAC - Required to create Roles for Flux controllers (namespace-scoped)
85+
# Security Note: The 'bind' and 'escalate' verbs are required for bootstrapping Flux.
86+
# These permissions allow the installation job to create Roles and RoleBindings for Flux
87+
# controllers within the release namespace when installing the agent-control-cd chart.
88+
# This is a known security trade-off in Kubernetes bootstrapping scenarios.
89+
# Mitigation: Scope is limited to the release namespace only (not cluster-wide).
90+
# The job is temporary and deleted after success (hook-delete-policy: hook-succeeded).
91+
- apiGroups: [ rbac.authorization.k8s.io ]
92+
resources:
93+
- roles
94+
- rolebindings
95+
verbs: [ get, list, create, update, patch, delete, bind, escalate ]
96+
97+
# Deployments - Required for Flux controllers and agent workloads
98+
- apiGroups: [ apps ]
99+
resources: [ deployments, daemonsets, statefulsets ]
100+
verbs: [ get, list, watch, create, update, patch, delete ]
101+
102+
# ReplicaSets - Required for Flux controllers
103+
- apiGroups: [ apps ]
104+
resources: [ replicasets ]
105+
verbs: [ get, list, watch ]
106+
107+
# Pods - Required to monitor Flux controllers and agents
108+
- apiGroups: [ "" ]
109+
resources: [ pods, pods/log ]
110+
verbs: [ get, list, watch ]
111+
112+
# Jobs - Required for Bootstrap installation/uninstallation jobs
113+
- apiGroups: [ batch ]
114+
resources: [ jobs ]
115+
verbs: [ get, list, watch, create, update, patch, delete ]
116+
117+
# Endpoints - Required for Flux service endpoint discovery
118+
- apiGroups: [ "" ]
119+
resources: [ endpoints ]
120+
verbs: [ get, list, watch ]
121+
122+
# Services - Required for Flux notification webhook
123+
- apiGroups: [ "" ]
124+
resources: [ services ]
125+
verbs: [ get, list, create, update, patch, delete ]
126+
127+
# Events - Required for Flux to emit events
128+
- apiGroups: [ "" ]
129+
resources: [ events ]
130+
verbs: [ get, list, watch, create, patch ]
131+
132+
# Leases - Required for Flux leader election
133+
- apiGroups: [ coordination.k8s.io ]
134+
resources: [ leases ]
135+
verbs: [ get, list, create, update, patch, delete ]
136+
137+
---
138+
apiVersion: rbac.authorization.k8s.io/v1
139+
kind: ClusterRoleBinding
140+
metadata:
141+
annotations:
142+
helm.sh/hook: post-install,post-upgrade
143+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
144+
helm.sh/hook-weight: "11"
145+
labels:
146+
{{- include "newrelic.common.labels" . | nindent 4 }}
147+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-install-job") }}
148+
namespace: {{ .Release.Namespace }}
13149
subjects:
14150
- kind: ServiceAccount
15151
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" .Release.Name "suffix" "install-job") }}
16152
namespace: {{ .Release.Namespace }}
17153
roleRef:
18154
kind: ClusterRole
19-
name: cluster-admin
155+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-install-job") }}
20156
apiGroup: rbac.authorization.k8s.io
21157
---
22158
apiVersion: rbac.authorization.k8s.io/v1
23-
kind: ClusterRoleBinding
159+
kind: RoleBinding
160+
metadata:
161+
annotations:
162+
helm.sh/hook: post-install,post-upgrade
163+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
164+
helm.sh/hook-weight: "11"
165+
labels:
166+
{{- include "newrelic.common.labels" . | nindent 4 }}
167+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-install-job") }}
168+
namespace: {{ .Release.Namespace }}
169+
subjects:
170+
- kind: ServiceAccount
171+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" .Release.Name "suffix" "install-job") }}
172+
namespace: {{ .Release.Namespace }}
173+
roleRef:
174+
kind: Role
175+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-install-job") }}
176+
apiGroup: rbac.authorization.k8s.io
177+
---
178+
apiVersion: rbac.authorization.k8s.io/v1
179+
kind: ClusterRole
180+
metadata:
181+
annotations:
182+
helm.sh/hook: pre-delete
183+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
184+
helm.sh/hook-weight: "-20"
185+
labels:
186+
{{- include "newrelic.common.labels" . | nindent 4 }}
187+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-uninstall-job") }}
188+
rules:
189+
# Namespaces - Required to delete agent-control namespace
190+
- apiGroups: [ "" ]
191+
resources: [ namespaces ]
192+
verbs: [ get, list, delete ]
193+
194+
# CRDs - Required to clean up Flux CRDs created during installation
195+
- apiGroups: [ apiextensions.k8s.io ]
196+
resources: [ customresourcedefinitions ]
197+
verbs: [ get, list, delete ]
198+
199+
# Flux Resources - Required to clean up HelmRepository and HelmRelease
200+
# Note: Limited to only the resource types that the installation job creates
201+
- apiGroups:
202+
- source.toolkit.fluxcd.io
203+
- helm.toolkit.fluxcd.io
204+
resources:
205+
- helmrepositories
206+
- helmreleases
207+
verbs: [ get, list, delete ]
208+
209+
# RBAC - Required to clean up ClusterRoles and ClusterRoleBindings for Flux controllers
210+
- apiGroups: [ rbac.authorization.k8s.io ]
211+
resources:
212+
- clusterroles
213+
- clusterrolebindings
214+
verbs: [ get, list, delete ]
215+
216+
---
217+
apiVersion: rbac.authorization.k8s.io/v1
218+
kind: Role
24219
metadata:
25220
annotations:
26221
helm.sh/hook: pre-delete
@@ -30,12 +225,96 @@ metadata:
30225
{{- include "newrelic.common.labels" . | nindent 4 }}
31226
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-uninstall-job") }}
32227
namespace: {{ .Release.Namespace }}
228+
rules:
229+
# Secrets - Required to clean up Flux and Agent Control credentials
230+
- apiGroups: [ "" ]
231+
resources: [ secrets ]
232+
verbs: [ get, list, delete ]
233+
234+
# ConfigMaps - Required to clean up Flux and Agent Control configuration
235+
- apiGroups: [ "" ]
236+
resources: [ configmaps ]
237+
verbs: [ get, list, delete ]
238+
239+
# ServiceAccounts - Required to clean up Flux controller service accounts
240+
- apiGroups: [ "" ]
241+
resources: [ serviceaccounts ]
242+
verbs: [ get, list, delete ]
243+
244+
# RBAC - Required to clean up Roles and RoleBindings for Flux controllers (namespace-scoped)
245+
- apiGroups: [ rbac.authorization.k8s.io ]
246+
resources:
247+
- roles
248+
- rolebindings
249+
verbs: [ get, list, delete ]
250+
251+
# Deployments - Required to clean up Flux controllers and agent workloads
252+
- apiGroups: [ apps ]
253+
resources: [ deployments, daemonsets, statefulsets ]
254+
verbs: [ get, list, delete ]
255+
256+
# ReplicaSets - Required to clean up Flux controllers
257+
- apiGroups: [ apps ]
258+
resources: [ replicasets ]
259+
verbs: [ get, list ]
260+
261+
# Jobs - Required to clean up Bootstrap installation jobs
262+
- apiGroups: [ batch ]
263+
resources: [ jobs ]
264+
verbs: [ get, list, delete ]
265+
266+
# Services - Required to clean up Flux notification webhook
267+
- apiGroups: [ "" ]
268+
resources: [ services ]
269+
verbs: [ get, list, delete ]
270+
271+
# Endpoints - Required for cleanup
272+
- apiGroups: [ "" ]
273+
resources: [ endpoints ]
274+
verbs: [ get, list ]
275+
276+
# Leases - Required to clean up Flux leader election leases
277+
- apiGroups: [ coordination.k8s.io ]
278+
resources: [ leases ]
279+
verbs: [ get, list, delete ]
280+
---
281+
apiVersion: rbac.authorization.k8s.io/v1
282+
kind: ClusterRoleBinding
283+
metadata:
284+
annotations:
285+
helm.sh/hook: pre-delete
286+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
287+
helm.sh/hook-weight: "-19"
288+
labels:
289+
{{- include "newrelic.common.labels" . | nindent 4 }}
290+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-uninstall-job") }}
291+
namespace: {{ .Release.Namespace }}
33292
subjects:
34293
- kind: ServiceAccount
35294
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" .Release.Name "suffix" "uninstall-job") }}
36295
namespace: {{ .Release.Namespace }}
37296
roleRef:
38297
kind: ClusterRole
39-
name: cluster-admin
298+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-uninstall-job") }}
299+
apiGroup: rbac.authorization.k8s.io
300+
---
301+
apiVersion: rbac.authorization.k8s.io/v1
302+
kind: RoleBinding
303+
metadata:
304+
annotations:
305+
helm.sh/hook: pre-delete
306+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
307+
helm.sh/hook-weight: "-19"
308+
labels:
309+
{{- include "newrelic.common.labels" . | nindent 4 }}
310+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-uninstall-job") }}
311+
namespace: {{ .Release.Namespace }}
312+
subjects:
313+
- kind: ServiceAccount
314+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" .Release.Name "suffix" "uninstall-job") }}
315+
namespace: {{ .Release.Namespace }}
316+
roleRef:
317+
kind: Role
318+
name: {{ include "newrelic.common.naming.truncateToDNSWithSuffix" (dict "name" (include "newrelic.common.naming.fullname" .) "suffix" "flux-uninstall-job") }}
40319
apiGroup: rbac.authorization.k8s.io
41320
{{- end -}}

0 commit comments

Comments
 (0)