RBAC fixes to Helm Chart#5
Conversation
gcaracuel
requested review from
adriantunez,
itek09 and
xavi-clovr
as code owners
There was a problem hiding this comment.
Pull Request Overview
This PR implements RBAC fixes for the Dapr Trust Bundle Helm Chart to improve permissions management and chart configuration. The changes focus on enhancing RBAC documentation, updating resource naming for consistency, and providing better user guidance.
- Improved RBAC configuration with better documentation and warnings
- Updated image configuration to use specific tag and pull policy
- Enhanced template naming consistency for metrics authentication resources
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| deploy/helm/dapr-trustbundle/values.yaml | Updated image config, removed leader election settings, enhanced RBAC documentation |
| deploy/helm/dapr-trustbundle/templates/role.yaml | Added detailed comments explaining RBAC permissions and simplified verb configuration |
| deploy/helm/dapr-trustbundle/templates/clusterrolebinding.yaml | Renamed proxy-rolebinding to metrics-auth-rolebinding for clarity |
| deploy/helm/dapr-trustbundle/templates/clusterrole.yaml | Renamed proxy-role to metrics-auth-role for consistency |
| deploy/helm/dapr-trustbundle/templates/NOTES.txt | Added RBAC warnings and updated pod selector labels |
| README.md | Added mermaid diagram showing component relationships |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| verbs: | ||
| - create | ||
| - delete |
There was a problem hiding this comment.
The removal of 'patch' and 'update' verbs may be problematic. The comment on line 21 suggests this rule is for creating secrets and configmaps, but the operator may need to update existing resources. Consider if patch/update permissions are needed for proper operation.
| verbs: | |
| - create | |
| - delete | |
| - delete | |
| - patch | |
| - update |
| 1. Check the status of the Dapr Trust Bundle Operator: | ||
|
|
||
| kubectl get pods -n {{ include "dapr-trustbundle.namespace" . }} -l control-plane=controller-manager | ||
| kubectl get pods -n {{ include "dapr-trustbundle.namespace" . }} -l control-plane=operator |
There was a problem hiding this comment.
The label selector has changed from 'controller-manager' to 'operator'. Ensure this matches the actual labels applied to the deployed pods, otherwise users won't be able to find the running pods with these commands.
No description provided.