I have Drone and Drone kubernetes Runner deployed into my kube cluster via the latest helm charts. I am using a custom plugin to deploy to kube based off of https://github.com/komljen/drone-kubectl-helm.
What is the problem:
For anyone that uses the plugin, they deploy the following k8s rolebinding and service account in order for the plugin to deploy to that given namespace:
--- apiVersion: v1 kind: ServiceAccount metadata: name: drone-user namespace: [namespace] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: drone-user namespace: [namespace] roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: user subjects: - kind: ServiceAccount name: drone-user namespace: [namespace]
Unfortunately, the plugin seems to pick up the service account that Drone-Kubernetes-Runner uses which allows it to deploy to ANY namespace and perform actions that may not be desired.I dont want that. I just want the person using the plugin to be able to deploy to their given namespace. The credentials to deploy use secrets created from drone cli: (1) kube-api-server (2) kubernetes-token (3) kubernetes-cert
What I’m asking for help on:
- Are there others that have run into similar problems?
- How do I overcome this?
- Are there other kube-plugins that you know of that resolve this (on plugins.drone.io there are about 5 kube plugins listed)
P.S. - There doesn’t seem to be any commented out notes regarding this on the helm chart for the deployment.