K8s Web Deployer Authorization #992

New Issue

srw · 2026-02-18T18:47:58Z

srw commented

2026-02-18 18:47:58 +00:00

Currently the web deployer relies on being deployed with a copy of the kubeconfig and uses this to authenticate to the k8s api.

This is an anti-pattern for a few reasons-- namely these credentials can control the entire cluster and they rotate approximately every 12 months, which would require a periodic re-deployment of the deployer.

This should be replaced using in cluster auth mechanics (RBAC)

dedicated service account, default to laconic but with some ability to override
role for namespaced permissions, this should account for #982
role binding to ServiceAccount

Currently the web deployer relies on being deployed with a copy of the kubeconfig and uses this to authenticate to the k8s api. This is an anti-pattern for a few reasons-- namely these credentials can control the entire cluster and they rotate approximately every 12 months, which would require a periodic re-deployment of the deployer. This should be replaced using in cluster auth mechanics (RBAC) - dedicated service account, default to _laconic_ but with some ability to override - role for namespaced permissions, this should account for https://git.vdb.to/cerc-io/stack-orchestrator/issues/982 - role binding to ServiceAccount

srw referenced this issue

2026-02-18 18:53:27 +00:00

K8s Add proper namespace support #982

srw added the

Priority

Critical

label 2026-02-18 18:54:06 +00:00

srw changed title from ~~Web Deployer Authorization~~ to K8s Web Deployer Authorization

2026-02-18 18:56:08 +00:00

srw added the

K8s

label 2026-02-18 19:03:48 +00:00