From b4d913e24ff9fc6c059af680e47a01fc96ab97d2 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Thu, 4 May 2023 11:45:51 +0100
Subject: [PATCH] fix(helm): explode verbs instead of wildcarding (#7405)

Updates the Helm chart role specification for Coder to explicitly list required verbs instead of requesting wildcard.
---
 helm/templates/rbac.yaml                      | 20 +++++++++++++++++--
 helm/tests/testdata/default_values.golden     | 20 +++++++++++++++++--
 helm/tests/testdata/labels_annotations.golden | 20 +++++++++++++++++--
 helm/tests/testdata/sa.golden                 | 20 +++++++++++++++++--
 helm/tests/testdata/tls.golden                | 20 +++++++++++++++++--
 5 files changed, 90 insertions(+), 10 deletions(-)

diff --git a/helm/templates/rbac.yaml b/helm/templates/rbac.yaml
index d11ac555c5..c5fae5d3a2 100644
--- a/helm/templates/rbac.yaml
+++ b/helm/templates/rbac.yaml
@@ -7,10 +7,26 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["pods"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
   - apiGroups: [""]
     resources: ["persistentvolumeclaims"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/helm/tests/testdata/default_values.golden b/helm/tests/testdata/default_values.golden
index e9f92678d4..1c859bc609 100644
--- a/helm/tests/testdata/default_values.golden
+++ b/helm/tests/testdata/default_values.golden
@@ -22,10 +22,26 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["pods"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
   - apiGroups: [""]
     resources: ["persistentvolumeclaims"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
 ---
 # Source: coder/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/helm/tests/testdata/labels_annotations.golden b/helm/tests/testdata/labels_annotations.golden
index f980dddf84..761b27af2f 100644
--- a/helm/tests/testdata/labels_annotations.golden
+++ b/helm/tests/testdata/labels_annotations.golden
@@ -22,10 +22,26 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["pods"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
   - apiGroups: [""]
     resources: ["persistentvolumeclaims"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
 ---
 # Source: coder/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/helm/tests/testdata/sa.golden b/helm/tests/testdata/sa.golden
index a6531600df..250d3e1e50 100644
--- a/helm/tests/testdata/sa.golden
+++ b/helm/tests/testdata/sa.golden
@@ -22,10 +22,26 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["pods"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
   - apiGroups: [""]
     resources: ["persistentvolumeclaims"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
 ---
 # Source: coder/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/helm/tests/testdata/tls.golden b/helm/tests/testdata/tls.golden
index 81a5e68f06..4d98456364 100644
--- a/helm/tests/testdata/tls.golden
+++ b/helm/tests/testdata/tls.golden
@@ -22,10 +22,26 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["pods"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
   - apiGroups: [""]
     resources: ["persistentvolumeclaims"]
-    verbs: ["*"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
 ---
 # Source: coder/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1