fix: add a few more permissions to reflect the current script requirements #1255
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
📝 WalkthroughWalkthroughThe pull request modifies the Kubernetes cluster role Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
monteiro-renato
temporarily deployed
to
reader
GitHub Actions
Inactive
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
infrastructure/adminservices-test/altinn-monitor-test-rg/k6_tests_rg_rbac.tf (1)
53-61: LGTM: Pod read access is appropriately restricted.The new rules for pods and pod logs are:
- Limited to read-only operations (get, list)
- More restrictive than the dev_access role
- Necessary for monitoring test execution
These permissions follow the principle of least privilege while providing the required functionality for test monitoring.
Consider documenting these permission requirements in the repository's documentation to help other teams understand the security implications and requirements when reusing this GitHub Action.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
infrastructure/adminservices-test/altinn-monitor-test-rg/k6_tests_rg_rbac.tf(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Analyze (go)
🔇 Additional comments (2)
infrastructure/adminservices-test/altinn-monitor-test-rg/k6_tests_rg_rbac.tf (2)
51-51: LGTM: TestRun monitoring permissions are appropriate.The addition of get, watch, and delete permissions for TestRuns is necessary for monitoring test execution and cleanup. These permissions match the dev_access role and are properly scoped to the k6.io API group.
41-41: LGTM: ConfigMap delete permission aligns with cleanup requirements.The addition of the "delete" permission for ConfigMaps is appropriate for test cleanup operations and matches the permissions in the dev_access role.
Let's verify the script's ConfigMap cleanup requirements:
✅ Verification successful
✓ Verified: ConfigMap permissions match script requirements
The RBAC permissions ["create", "update", "delete"] align perfectly with the script's operations:
- Creates ConfigMaps for test archives
- Deletes ConfigMaps during cleanup
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Search for ConfigMap cleanup operations in the referenced script curl -s https://raw.githubusercontent.com/Altinn/dialogporten/8f5ce91209f5417eba04e60d8ce6c170f9969a16/tests/k6/tests/scripts/run-test-in-k8s.sh | grep -A 5 "configmap"Length of output: 1644
Terraform environment testFormat and Style 🖌
|
| Context | Values |
|---|---|
| Pusher | @monteiro-renato |
| Action | push |
| Working Directory | ./infrastructure/adminservices-test/altinn-monitor-test-rg |
| State File | github.com/altinn/altinn-platform/environments/test/altinn-monitor-test-rg.tfstate |
| Plan File | github.com_altinn_altinn-platform_environments_test_altinn-monitor-test-rg.tfstate.tfplan |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To fit the current script's needs.
I'm working on a Github Action that can be re-used by multiple teams.
Summary by CodeRabbit