Add Kubernetes Node Reader Role

wemogy · Jul 6, 2023 · 4be9ae1 · 4be9ae1
1 parent 4b2a056
commit 4be9ae1
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 0 deletions.
diff --git a/src/terraform-aks/templates/kubernetes_role_bindings.tf b/src/terraform-aks/templates/kubernetes_role_bindings.tf
@@ -17,6 +17,24 @@ resource "kubernetes_cluster_role_binding" "developer_view" {
   }
 }
 
+# Give developers view access to the noes
+resource "kubernetes_cluster_role_binding" "developer_node_reader" {
+  metadata {
+    name = "${var.project}-developer-node-reader"
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "node-reader"
+  }
+
+  subject {
+    kind = "Group"
+    name = var.azure_aad_group_developers_id
+  }
+}
+
 # Give developers port-forward access to the whole cluster
 resource "kubernetes_cluster_role_binding" "developer_port_forwarder" {
   metadata {

diff --git a/src/terraform-aks/templates/kubernetes_roles.tf b/src/terraform-aks/templates/kubernetes_roles.tf
@@ -9,3 +9,15 @@ resource "kubernetes_cluster_role" "port_forwarder" {
     verbs      = ["*"]
   }
 }
+
+resource "kubernetes_cluster_role" "node_reader" {
+  metadata {
+    name = "node-reader"
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["nodes"]
+    verbs      = ["get", "watch", "list"]
+  }
+}