update helm for zxporter rbac#172
Merged
Merged
Conversation
WalkthroughExpanded ClusterRole for the manager with broader, adjusted permissions across many apiGroups. Introduced metrics-specific roles (auth and reader) and a corresponding ClusterRoleBinding to the controller ServiceAccount. Retained and aligned leader-election and manager role bindings within the same RBAC template. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Prom as Prometheus
participant KAPI as Kubernetes API Server
participant AuthZ as authorization.k8s.io
participant AuthN as authentication.k8s.io
participant Ctrl as zxporter Controller
Note over Prom,KAPI: Metrics scrape flow
Prom->>KAPI: GET /apis/.../subjectaccessreviews (create)
KAPI->>AuthZ: SubjectAccessReview for GET /metrics
AuthZ-->>KAPI: Decision (allow/deny)
KAPI-->>Prom: Allowed to access /metrics
Prom->>Ctrl: GET /metrics
Ctrl-->>Prom: Metrics payload
Note over Ctrl,KAPI: Controller RBAC usage (read/watch)
Ctrl->>KAPI: list/watch resources across apiGroups
KAPI-->>Ctrl: Resource events/objects
Estimated code review effort🎯 4 (Complex) | ⏱️ ~55 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
helm-chart/zxporter/templates/zxporter-rbac.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Build Docker Image
- GitHub Check: Build Docker Image
- GitHub Check: Analyze (go)
Comment on lines
+127
to
+160
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - configmaps | ||
| - endpoints | ||
| - events | ||
| - limitranges | ||
| - namespaces | ||
| - nodes | ||
| - persistentvolumeclaims | ||
| - persistentvolumes | ||
| - pods | ||
| - replicationcontrollers | ||
| - resourcequotas | ||
| - serviceaccounts | ||
| - services | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - nodes/metrics | ||
| - nodes/status | ||
| - pods/status | ||
| verbs: | ||
| - get | ||
| - apiGroups: | ||
| - apiextensions.k8s.io | ||
| resources: | ||
| - customresourcedefinitions | ||
| verbs: | ||
| - get |
There was a problem hiding this comment.
Restore event create permissions for the manager.
Placing events in the read-only core rule strips the manager of create/patch on events, so the controller can no longer emit Kubernetes Events (you’ll get Forbidden errors from the event recorder). Please split out events and add back the write verbs:
- - configmaps
- - endpoints
- - events
+ - configmaps
+ - endpoints
- limitranges
...
- - watch
+ - watch
+- apiGroups:
+ - ""
+ resources:
+ - events
+ verbs:
+ - create
+ - patch
+ - get
+ - list
+ - watch📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - apiGroups: | |
| - "" | |
| resources: | |
| - configmaps | |
| - endpoints | |
| - events | |
| - limitranges | |
| - namespaces | |
| - nodes | |
| - persistentvolumeclaims | |
| - persistentvolumes | |
| - pods | |
| - replicationcontrollers | |
| - resourcequotas | |
| - serviceaccounts | |
| - services | |
| verbs: | |
| - get | |
| - list | |
| - watch | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - nodes/metrics | |
| - nodes/status | |
| - pods/status | |
| verbs: | |
| - get | |
| - apiGroups: | |
| - apiextensions.k8s.io | |
| resources: | |
| - customresourcedefinitions | |
| verbs: | |
| - get | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - configmaps | |
| - endpoints | |
| - limitranges | |
| - namespaces | |
| - nodes | |
| - persistentvolumeclaims | |
| - persistentvolumes | |
| - pods | |
| - replicationcontrollers | |
| - resourcequotas | |
| - serviceaccounts | |
| - services | |
| verbs: | |
| - get | |
| - list | |
| - watch | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - events | |
| verbs: | |
| - create | |
| - patch | |
| - get | |
| - list | |
| - watch | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - nodes/metrics | |
| - nodes/status | |
| - pods/status | |
| verbs: | |
| - get | |
| - apiGroups: | |
| - apiextensions.k8s.io | |
| resources: | |
| - customresourcedefinitions | |
| verbs: | |
| - get |
🤖 Prompt for AI Agents
In helm-chart/zxporter/templates/zxporter-rbac.yaml around lines 127 to 160, the
current rule lists "events" under a read-only core rule which removes the
manager's ability to emit events; remove "events" from that read-only resources
list and add a separate RBAC rule for apiGroups: [""] with resources: ["events"]
and verbs: ["create","patch","update"] so the controller can create and update
Kubernetes Events (ensure the new rule is placed alongside the other core
rules).
sandipanpanda
approved these changes
Oct 14, 2025
Merged
Parthiba-Hazra
added a commit
that referenced
this pull request
May 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit