Repository navigation
fix(helm): tighten readonly-access guards and grant /version - #66
Merged
tim-thacker-nullify merged 3 commits intoSep 15, 2026
Merged
tim-thacker-nullify merged 3 commits into
tim-thacker-nullify merged 3 commits into
Conversation
…ra rules - extraSubjects: any name starting "system:" (trimmed, case-insensitive) fails whatever its kind; kinds are limited to User, Group and ServiceAccount; ServiceAccounts in kube-system, kube-public and kube-node-lease fail. - extraRules: reject wildcard apiGroups or resources, the exec, attach, portforward, proxy and log subresources, and nonResourceURLs other than /version. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The strict managed scan records a ServerVersion() failure and fails the cluster, so a cluster without the default system:public-info-viewer binding could not be scanned. The raw manifest carries the same rule, and the manifest check fails if either side drops it. NOTES lists the egress IPs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ctor Namespace - Helm 3.2+ adopts the manifest's objects once they carry Helm ownership metadata, so moving to Helm no longer needs a delete and a scan outage. - List Nullify egress IPs per region for the EKS public endpoint. - The collector no longer creates a Namespace (#63). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
tim-thacker-nullify
merged commit Sep 15, 2026
43972fc
into
feat/helm-readonly-access-chart
6 checks passed
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#61's guards let
extraSubjectsbindsystem:anonymousandextraRulesaddpods/exec, and a denied/versionfails the strict scan.Merge order: this into #61; #61 after #60 (see #60's fix PR).
system:fail (trimmed, any case);groupNametoo.User,Group,ServiceAccount.kube-system,kube-public,kube-node-leasefail.extraRulesrejects:*inapiGroupsorresources;exec,attach,portforward,proxy,logsubresources, sonodes/proxy,services/proxyandpods/logtoo (logadded: README promises no log access);nonResourceURLsother than/version.geton/version(collect.go:106-111);check-rbac-manifest.shfails if either side drops it.Namespace; grant line adds/version.pods/exec,nodes/proxy,*resource,*apiGroup,/metrics);ci/customised.yamladds an SA subject andget deployments/scale.Root README tree lines for
pre-install-job.yamlare left to #63: both PRs edit them and conflict anyway.Nothing rendered locally; CI runs lint, render, must-fail cases and the manifest diff.
🤖 Generated with Claude Code