Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[appmesh spire server] Limit spire configmap access to namespace #717

Merged
merged 1 commit into from
Mar 24, 2022

Conversation

bendu
Copy link
Contributor

@bendu bendu commented Mar 22, 2022

Issue

Description of changes

Moving the configmap permission for spire-server account from ClusterRole to Role. Role scopes the configmap access down to a single namespace. Spire only needs to read config maps in its own namespace.

Checklist

  • Added/modified documentation as required (such as the README.md for modified charts)
  • Incremented the chart version in Chart.yaml for the modified chart(s)
  • Manually tested. Describe what testing was done in the testing section below
  • Make sure the title of the PR is a good description that can go into the release notes

Testing

  1. Removed the configmap permission and confirmed that spire server broke upon pod restart.
  2. Added role and role binding in to confirm that spire server worked once more.
  3. Set up some new certificates. Confirmed that App Mesh was able to consume them.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@cgchinmay cgchinmay merged commit f175234 into aws:master Mar 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants