alex/infrastructure
Watch
1
0
Fork
You've already forked infrastructure
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Allow Hermes to create Secrets except in kube-system #222

Merged
alex merged 1 commit from wiring-guru/hermes-secret-create-rbac into main 2026-11-11 11:12:16 -07:00 AGit
Conversation 0 Commits 1 Files changed 2 +41
wiring-guru commented 2026-11-11 11:11:21 -07:00
Contributor
Copy link

Grant create-only on core Secrets cluster-wide and create on Namespaces. A fail-closed ValidatingAdmissionPolicy denies Secret CREATE by system:serviceaccount:hermes:hermes in kube-system; Argo sync waves install policy and binding before the RBAC grant. No Secret get/list/watch, patch, update or delete granted. Review before merging; merge triggers GitOps. kubectl auth can-i tests RBAC only, not the admission-policy denial in kube-system.

Grant create-only on core Secrets cluster-wide and create on Namespaces. A fail-closed ValidatingAdmissionPolicy denies Secret CREATE by system:serviceaccount:hermes:hermes in kube-system; Argo sync waves install policy and binding before the RBAC grant. No Secret get/list/watch, patch, update or delete granted. Review before merging; merge triggers GitOps. kubectl auth can-i tests RBAC only, not the admission-policy denial in kube-system.
Grant create-only on core Secrets across namespaces and create on Namespaces. Enforce the kube-system exclusion with a fail-closed ValidatingAdmissionPolicy scoped to the Hermes service account; sync the policy and binding before the RBAC expansion. Secret get/list/watch remain denied.
alex merged commit ef97f99024 into main 2026-11-11 11:12:16 -07:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
alex/infrastructure!222
No description provided.