Minimal rbac to view and reconcile resources in UI #3702
Description
Hi there
We are currently trying to limit the flux resources which a specific user/group can see & use (e.g. sync).
We tried to apply the following role, but the user doesn't see any resources matching the names specified.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: example
namespace: tenant-1
- apiGroups:
- kustomize.toolkit.fluxcd.io
resourceNames:
- example-kustomization
resources:
- kustomizations
verbs:
- get
- list
- watch
- patch
- apiGroups:
- source.toolkit.fluxcd.io
resourceNames:
- example-gitrepository
resources:
- gitrepositories
verbs:
- get
- list
- watch
- patch
The following requests over kubectl work:
kubectl get kustomizations.kustomize.toolkit.fluxcd.io -n tenant-1 example-kustomization
kubectl get gitrepositories.source.toolkit.fluxcd.io -n tenant-1 example-gitrepository
Additionally setting
# Read access for all other Kubernetes objects
- apiGroups: ["*"]
resources: ["*"]
verbs: [ "get", "list", "watch" ]
according to the docs, the user can see "too much".