Feat: Implement Principle of least privilege

charts/onelens-agent/Chart.yaml

@@ -2,15 +2,15 @@ apiVersion: v2
 name: onelens-agent
 description: Helm chart for the OneLens Agent
 type: application
-version: 1.8.0
-appVersion: 1.8.0
+version: 1.9.0
+appVersion: 1.9.0
 maintainers:
   - name: OneLens
     email: support@onelens.ai
 dependencies:
   - name: onelens-agent-base
     repository: oci://609916866699.dkr.ecr.ap-south-1.amazonaws.com/helm-charts
-    version: 1.8.0
+    version: 1.9.0
     alias: onelens-agent
     condition: onelens-agent.enabled
   - name: prometheus

charts/onelens-agent/values.yaml

@@ -2,7 +2,7 @@ onelens-agent:
   enabled: true
   image:
     repository: public.ecr.aws/w7k6q5m9/onelens-agent
-    tag: v1.8.0
+    tag: v1.9.0
     pullPolicy: IfNotPresent
   nameOverride: "onelens-agent"
   fullnameOverride: "onelens-agent"

charts/onelensdeployer/Chart.yaml

@@ -5,5 +5,5 @@ maintainers:
     email: support@onelens.cloud
 name: onelensdeployer
 type: application
-version: 1.8.0
-appVersion: 1.8.0
+version: 1.9.0
+appVersion: 1.9.0

charts/onelensdeployer/templates/bootstrap-clusterrole.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.bootstrapRbac.clusterRole.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.bootstrapRbac.clusterRole.name }}
+rules:
+{{- toYaml .Values.bootstrapRbac.clusterRole.rules | nindent 2 }}
+{{- end }}
+

charts/onelensdeployer/templates/bootstrap-clusterrolebinding.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.bootstrapRbac.clusterRoleBinding.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Values.bootstrapRbac.clusterRoleBinding.name }}
+subjects:
+  # Only bind the installation job service account to bootstrap ClusterRole
+  {{- if .Values.job.serviceAccount.enabled }}
+  - kind: ServiceAccount
+    name: {{ .Values.job.serviceAccount.name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Values.bootstrapRbac.clusterRole.name }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
+

charts/onelensdeployer/templates/clusterole.yaml

@@ -1,14 +1,8 @@
+{{- if .Values.rbac.clusterRole.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ .Values.job.clusterRole.name }}
+  name: {{ .Values.rbac.clusterRole.name }}
 rules:
-{{- toYaml .Values.job.clusterRole.rules | nindent 2 }}
-
---- 
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Values.cronjob.clusterRole.name }}
-rules:
-{{- toYaml .Values.cronjob.clusterRole.rules | nindent 2 }}
+{{- toYaml .Values.rbac.clusterRole.rules | nindent 2 }}
+{{- end }}

charts/onelensdeployer/templates/clusterrolebinding.yaml

@@ -1,26 +1,22 @@
+{{- if .Values.rbac.clusterRoleBinding.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ .Values.job.clusterRoleBinding.name }}
+  name: {{ .Values.rbac.clusterRoleBinding.name }}
 subjects:
+  # Bind both job and cronjob service accounts to the shared ClusterRole
+  {{- if .Values.job.serviceAccount.enabled }}
   - kind: ServiceAccount
     name: {{ .Values.job.serviceAccount.name }}
     namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ .Values.job.clusterRole.name }}
-  apiGroup: rbac.authorization.k8s.io
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ .Values.cronjob.clusterRoleBinding.name }}
-subjects:
+  {{- end }}
+  {{- if .Values.cronjob.serviceAccount.enabled }}
   - kind: ServiceAccount
     name: {{ .Values.cronjob.serviceAccount.name }}
     namespace: {{ .Release.Namespace }}
+  {{- end }}
 roleRef:
   kind: ClusterRole
-  name: {{ .Values.cronjob.clusterRole.name }}
-  apiGroup: rbac.authorization.k8s.io
+  name: {{ .Values.rbac.clusterRole.name }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/onelensdeployer/templates/role.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.rbac.role.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Values.rbac.role.name }}
+  namespace: {{ .Release.Namespace }}
+rules:
+{{- toYaml .Values.rbac.role.rules | nindent 2 }}
+{{- end }}
+

charts/onelensdeployer/templates/rolebinding.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.rbac.roleBinding.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Values.rbac.roleBinding.name }}
+  namespace: {{ .Release.Namespace }}
+subjects:
+  # Bind both job and cronjob service accounts to the shared Role
+  {{- if .Values.job.serviceAccount.enabled }}
+  - kind: ServiceAccount
+    name: {{ .Values.job.serviceAccount.name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  {{- if .Values.cronjob.serviceAccount.enabled }}
+  - kind: ServiceAccount
+    name: {{ .Values.cronjob.serviceAccount.name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+roleRef:
+  kind: Role
+  name: {{ .Values.rbac.role.name }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
+