Skip to content

Commit 648ad82

Browse files
lexfreilexfrei
committed
refactor(postgres-operator): scope webhook-ready RBAC to release namespace
Address review feedback from gemini-code-assist on packages/system/postgres-operator/templates/webhook-ready-hook.yaml:83. The Job targets the cnpg-webhook-service/services/proxy subresource, which is namespaced and lives in the release namespace. A namespaced Role and RoleBinding grant the exact permission needed without creating global RBAC for a namespaced probe, which is the principle of least privilege. Also update the kind assertions in tests/webhook-ready-hook_test.yaml so the unittest suite tracks the new Role/RoleBinding objects. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent 9b87bda commit 648ad82

2 files changed

Lines changed: 8 additions & 6 deletions

File tree

‎packages/system/postgres-operator/templates/webhook-ready-hook.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,10 @@ metadata:
5252
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
5353
---
5454
apiVersion: rbac.authorization.k8s.io/v1
55-
kind: ClusterRole
55+
kind: Role
5656
metadata:
5757
name: {{ .Release.Name }}-webhook-ready
58+
namespace: {{ .Release.Namespace }}
5859
annotations:
5960
helm.sh/hook: post-install,post-upgrade
6061
helm.sh/hook-weight: "0"
@@ -66,16 +67,17 @@ rules:
6667
verbs: ["get"]
6768
---
6869
apiVersion: rbac.authorization.k8s.io/v1
69-
kind: ClusterRoleBinding
70+
kind: RoleBinding
7071
metadata:
7172
name: {{ .Release.Name }}-webhook-ready
73+
namespace: {{ .Release.Namespace }}
7274
annotations:
7375
helm.sh/hook: post-install,post-upgrade
7476
helm.sh/hook-weight: "0"
7577
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
7678
roleRef:
7779
apiGroup: rbac.authorization.k8s.io
78-
kind: ClusterRole
80+
kind: Role
7981
name: {{ .Release.Name }}-webhook-ready
8082
subjects:
8183
- kind: ServiceAccount

‎packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ release:
99
namespace: cozy-postgres-operator
1010

1111
tests:
12-
- it: renders four hook objects (SA + ClusterRole + ClusterRoleBinding + Job)
12+
- it: renders four hook objects (SA + Role + RoleBinding + Job)
1313
template: templates/webhook-ready-hook.yaml
1414
asserts:
1515
- hasDocuments:
@@ -49,15 +49,15 @@ tests:
4949
- documentIndex: 1
5050
equal:
5151
path: kind
52-
value: ClusterRole
52+
value: Role
5353
- documentIndex: 1
5454
equal:
5555
path: metadata.annotations["helm.sh/hook-weight"]
5656
value: "0"
5757
- documentIndex: 2
5858
equal:
5959
path: kind
60-
value: ClusterRoleBinding
60+
value: RoleBinding
6161
- documentIndex: 2
6262
equal:
6363
path: metadata.annotations["helm.sh/hook-weight"]

0 commit comments

Comments
 (0)