update
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index 830e372..4910e72 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -39,8 +39,7 @@
kind: Role
name: {{ template "cert-manager.fullname" . }}:leaderelection
subjects:
- - apiGroup: ""
- kind: ServiceAccount
+ - kind: ServiceAccount
name: {{ template "cert-manager.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
@@ -165,6 +164,9 @@
- apiGroups: ["acme.cert-manager.io"]
resources: ["orders/finalizers"]
verbs: ["update"]
+ - apiGroups: ["cert-manager.io"]
+ resources: ["clusterissuers/finalizers", "issuers/finalizers"]
+ verbs: ["update"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch"]
@@ -213,8 +215,8 @@
- apiGroups: ["networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get", "list", "watch", "create", "delete", "update"]
- - apiGroups: [ "gateway.networking.k8s.io" ]
- resources: [ "httproutes" ]
+ - apiGroups: ["gateway.networking.k8s.io"]
+ resources: ["httproutes"]
verbs: ["get", "list", "watch", "create", "delete", "update"]
# We require the ability to specify a custom hostname when we are creating
# new ingress resources.
@@ -263,10 +265,10 @@
resources: ["ingresses/finalizers"]
verbs: ["update"]
- apiGroups: ["gateway.networking.k8s.io"]
- resources: ["gateways", "httproutes"]
+ resources: ["gateways", "httproutes", "listenersets"]
verbs: ["get", "list", "watch"]
- apiGroups: ["gateway.networking.k8s.io"]
- resources: ["gateways/finalizers", "httproutes/finalizers"]
+ resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"]
verbs: ["update"]
- apiGroups: [""]
resources: ["events"]
@@ -398,6 +400,26 @@
namespace: {{ include "cert-manager.namespace" . }}
kind: ServiceAccount
+{{- if .Values.global.rbac.aggregateClusterRoles }}
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: {{ template "cert-manager.fullname" . }}-cluster-view
+ labels:
+ app: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/name: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "controller"
+ {{- include "labels" . | nindent 4 }}
+ rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
+rules:
+ - apiGroups: ["cert-manager.io"]
+ resources: ["clusterissuers"]
+ verbs: ["get", "list", "watch"]
+
+{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
@@ -414,6 +436,7 @@
rbac.authorization.k8s.io/aggregate-to-view: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
+ rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
{{- end }}
rules:
- apiGroups: ["cert-manager.io"]
@@ -447,12 +470,34 @@
- apiGroups: ["cert-manager.io"]
resources: ["certificates/status"]
verbs: ["update"]
+ {{- /*
+ Challenge and Order resources are not intended to be created by users
+ (GHSA-8rvj-mm4h-c258).
+
+ Challenges: "create" is excluded because a user-created Challenge with
+ attacker-controlled spec.solver can exfiltrate ClusterIssuer credentials
+ cross-namespace. "patch" and "update" are retained because spec is
+ immutable after creation (ValidateChallengeUpdate) so they cannot change
+ solver config, and because users need them to remove stuck finalizers
+ (see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
+
+ Orders: "create", "patch", and "update" are excluded because a user
+ who can update an Order can change spec.issuerRef to reference a
+ different ClusterIssuer, then delete the Challenge; the Orders
+ controller recreates the Challenge with the attacker-chosen Issuer's
+ solver config, exfiltrating its credentials.
+ */}}
- apiGroups: ["acme.cert-manager.io"]
- resources: ["challenges", "orders"]
- verbs: ["create", "delete", "deletecollection", "patch", "update"]
+ resources: ["challenges"]
+ verbs: ["delete", "deletecollection", "patch", "update"]
+ - apiGroups: ["acme.cert-manager.io"]
+ resources: ["orders"]
+ verbs: ["delete", "deletecollection"]
---
+{{- if not .Values.disableAutoApproval -}}
+
# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
@@ -468,7 +513,12 @@
- apiGroups: ["cert-manager.io"]
resources: ["signers"]
verbs: ["approve"]
- resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
+ {{- with .Values.approveSignerNames }}
+ resourceNames:
+ {{- range . }}
+ - {{ . | quote }}
+ {{- end }}
+ {{- end }}
---
@@ -493,8 +543,10 @@
---
+{{- end -}}
+
# Permission to:
-# - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers
+# - Update and sign CertificateSigningRequests referencing cert-manager.io Issuers and ClusterIssuers
# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole