feat(agent,shield): grant endpointslices RBAC for EndpointSlice watch - #2667
Open
matteo-porta wants to merge 7 commits into
Open
feat(agent,shield): grant endpointslices RBAC for EndpointSlice watch#2667matteo-porta wants to merge 7 commits into
matteo-porta wants to merge 7 commits into
Conversation
Contributor
|
Hi @matteo-porta. Thanks for your PR. After inspecting your changes someone with write access to this repo needs |
matteo-porta
changed the title
The agent now watches discovery.k8s.io/EndpointSlices instead of the deprecated core/v1 Endpoints. Grant get/list/watch on endpointslices so the network-topology informer is not denied. The core endpoints permission is retained for rollout compatibility.
Host Shield enables network_topology when network_security is on, which runs the endpoint watcher. That watcher now lists/watches discovery.k8s.io/EndpointSlices instead of the deprecated core/v1 Endpoints, so grant get/list/watch on endpointslices. The core endpoints grant is retained for rollout compatibility.
matteo-porta
force-pushed
the
matteo/agent-endpointslices-rbac
branch
from
July 1, 2026 11:39
cc4d409 to
57a40d1
Compare
ct lint renders this template with envsubst. When SECURE_AGENT_TOKEN is empty the unquoted value left a trailing space (accessKey: ), which yamllint's trailing-spaces rule rejects and failed the agent chart lint. Quoting renders accessKey: "" (empty) or the real value, both valid and trailing-space free.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it
The agent watches Service endpoint data for its network-topology feature. It is moving from the deprecated
core/v1EndpointsAPI todiscovery.k8s.ioEndpointSlice. The ClusterRoles that run this watcher only grant the coreendpointsresource, so once the agent issuesEndpointSlicelist/watch calls they are denied (Forbidden) and endpoint topology data is silently lost.This grants
get/list/watchondiscovery.k8s.io/endpointslicesin the roles that run the watcher. The existing coreendpointsgrant is intentionally retained so older agents keep working during rollout.Scope
agentchart — the agent ClusterRole runs the watcher; add the rule.shieldchart, host role — Host Shield setsnetwork_topology.enabled = network_security.enabled(seetemplates/host/_configmap_helpers.tpl), so the host agent runs the same watcher; add the rule.shieldchart, cluster role — already grantsdiscovery.k8s.io/endpointslices(gated onkubernetes_metadata/network_security); no change needed.Files
charts/agent/templates/clusterrole.yaml— addendpointslicesrule.charts/agent/tests/clusterrole_test.yaml— assert the rule.charts/agent/Chart.yaml—2.8.2→2.8.3.charts/shield/templates/host/clusterrole.yaml— addendpointslicesrule.charts/shield/tests/host/clusterrole_test.yaml— assert the rule.charts/shield/Chart.yaml—1.45.0→1.45.1.Test plan
helm unittest charts/agentandhelm unittest charts/shield— existing suites pass, new assertions green.helm template→ agent ClusterRole and shield host ClusterRole each contain bothendpointsandendpointslices.Checklist
feat(agent,shield):)_testsuffix