IvanHunters caaf4f90d4 fix(dashboard): restrict RBAC to cluster-scoped resources and cleanup naming ...

Remove namespace-scoped resources (tenantsecrets, tenantnamespaces,
tenantmodules, virtualmachineinstances, virtualmachineinstances/vnc) from
the cozystack-dashboard-readonly ClusterRole bound to system:authenticated.
These resources must be accessed via per-namespace RoleBindings created by
the tenant operator, not through a cluster-wide grant to all authenticated
users.

Only truly cluster-scoped, public-by-design resources remain in the
ClusterRole: applicationdefinitions, storageclasses, backupclasses,
and dashboard.cozystack.io customization resources.

Also rename the leftover incloud-web-web-user-edit ClusterRoleBinding to
cozystack-dashboard-cluster-admin to match the new naming convention, and
declare Makefile targets as .PHONY.

Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>

2026-04-30 00:37:28 +03:00

..

apps

fix(kubernetes): close admin-kubeconfig race on tenant cluster bootstrap (#2413)

2026-04-27 15:31:52 +03:00

core

Prepare release v1.3.0

2026-04-22 07:28:09 +00:00

extra

Prepare release v1.3.0

2026-04-22 07:28:09 +00:00

library

[cozy-lib] Add a hexToInt helper

2026-03-19 07:29:50 +03:00

system

fix(dashboard): restrict RBAC to cluster-scoped resources and cleanup naming

2026-04-30 00:37:28 +03:00

tests/cozy-lib-tests

refactor: replace Helm lookup with valuesFrom mechanism

2026-01-05 16:10:55 +01:00