Refactor RBAC configuration to use ClusterRole and ClusterRoleBinding for k8s-mgmt-pod with expanded resource permissions, while retaining security.

k8s/rbac.yaml

@@ -1,49 +1,189 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
   name: k8s-mgmt-pod
 rules:
-  # This is intentionally broader than the strict minimum so lfk and kubectl are usable.
-  # Scope it down to the smallest verb and resource set your operators actually need.
   - apiGroups: [""]
     resources:
       - configmaps
       - endpoints
       - events
+      - limitranges
+      - namespaces
+      - nodes
       - persistentvolumeclaims
+      - persistentvolumes
       - pods
-      - pods/exec
       - pods/log
-      - secrets
+      - pods/portforward
+      - pods/proxy
+      - replicationcontrollers
+      - replicationcontrollers/scale
+      - resourcequotas
       - serviceaccounts
       - services
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+      - services/proxy
+    verbs: ["*"]
   - apiGroups: ["apps"]
     resources:
+      - controllerrevisions
       - daemonsets
       - deployments
+      - deployments/scale
       - replicasets
+      - replicasets/scale
       - statefulsets
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+      - statefulsets/scale
+    verbs: ["*"]
   - apiGroups: ["batch"]
     resources:
       - cronjobs
       - jobs
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+    verbs: ["*"]
+  - apiGroups: ["autoscaling"]
+    resources:
+      - horizontalpodautoscalers
+    verbs: ["*"]
   - apiGroups: ["networking.k8s.io"]
     resources:
+      - ingressclasses
       - ingresses
-      - networkpolicies
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+    verbs: ["*"]
+  - apiGroups: ["extensions"]
+    resources:
+      - ingresses
+    verbs: ["*"]
+  - apiGroups: ["policy"]
+    resources:
+      - poddisruptionbudgets
+    verbs: ["*"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources:
+      - leases
+    verbs: ["*"]
+  - apiGroups: ["storage.k8s.io"]
+    resources:
+      - csidrivers
+      - csinodes
+      - csistoragecapacities
+      - storageclasses
+      - volumeattachments
+    verbs: ["*"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources:
+      - customresourcedefinitions
+    verbs: ["*"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources:
+      - mutatingadmissionpolicies
+      - mutatingwebhookconfigurations
+      - validatingadmissionpolicies
+      - validatingwebhookconfigurations
+    verbs: ["*"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources:
+      - nodes
+      - pods
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources:
+      - gatewayclasses
+      - gateways
+      - httproutes
+      - referencegrants
+      - tcproutes
+      - tlsroutes
+      - udproutes
+    verbs: ["*"]
+  - apiGroups: ["cert-manager.io"]
+    resources:
+      - certificates
+      - certificaterequests
+      - clusterissuers
+      - issuers
+    verbs: ["*"]
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - alertmanagers
+      - podmonitors
+      - prometheuses
+      - prometheusrules
+      - servicemonitors
+      - thanosrulers
+    verbs: ["*"]
+  - apiGroups: ["argoproj.io"]
+    resources:
+      - applications
+      - appprojects
+    verbs: ["*"]
+  - apiGroups: ["traefik.containo.us", "traefik.io"]
+    resources:
+      - ingressroutes
+      - middlewares
+      - traefikservices
+    verbs: ["*"]
+  - apiGroups: ["k8s.cni.cncf.io"]
+    resources:
+      - network-attachment-definitions
+    verbs: ["*"]
+  - apiGroups: ["kubevirt.io"]
+    resources:
+      - virtualmachineinstances
+      - virtualmachines
+    verbs: ["*"]
+  - apiGroups: ["subresources.kubevirt.io"]
+    resources:
+      - "*"
+    verbs: ["*"]
+  - apiGroups: ["instancetype.kubevirt.io"]
+    resources:
+      - "*"
+    verbs: ["*"]
+  - apiGroups: ["cdi.kubevirt.io"]
+    resources:
+      - "*"
+    verbs: ["*"]
+  - apiGroups: ["pool.kubevirt.io"]
+    resources:
+      - "*"
+    verbs: ["*"]
+  - apiGroups: ["cluster.x-k8s.io"]
+    resources:
+      - clusters
+      - machinedeployments
+      - machinepools
+      - machines
+      - machinesets
+    verbs: ["*"]
+  - apiGroups: ["controlplane.cluster.x-k8s.io"]
+    resources:
+      - kubeadmcontrolplanes
+    verbs: ["*"]
+  - apiGroups: ["bootstrap.cluster.x-k8s.io"]
+    resources:
+      - kubeadmconfigs
+      - kubeadmconfigtemplates
+    verbs: ["*"]
+  - apiGroups: ["infrastructure.cluster.x-k8s.io"]
+    resources:
+      - kubevirtclusters
+      - kubevirtmachinetemplates
+    verbs: ["*"]
+  - apiGroups: ["addons.cluster.x-k8s.io"]
+    resources:
+      - clusterresourcesets
+    verbs: ["*"]
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
-  name: k8s-mgmt-pod
+  name: k8s-mgmt-pod-access
 subjects:
   - kind: ServiceAccount
     name: k8s-mgmt-pod
+    namespace: k8s-mgmt-pod
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: k8s-mgmt-pod