Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix: fix incorrect rendering of RBAC in Helm chart when workspacePerms=false #20569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 30, 2025
Merged

fix: fix incorrect rendering of RBAC in Helm chart when workspacePerms=false #20569

merged 2 commits into from
Oct 30, 2025
+4 −88

Conversation

@rowansmithau
Copy link
Contributor

@rowansmithau rowansmithau commented Oct 30, 2025

closes #20562.

When I added workspaceNamespaces it caused an issue when workspacePerms is set to false in that the Role & RoleBinding was still created.

Update with workspacePerms=false:

➜  coder git:(rowan/helm_rbac_fix) ✗ helm template coder . --version=2.27.2  --set coder.image.tag=v2.27.2 --set coder.serviceAccount.workspacePerms=false | grep -A11 -B46 RoleBinding
➜  coder git:(rowan/helm_rbac_fix) ✗

Update with workspacePerms=true:

➜  coder git:(rowan/helm_rbac_fix) ✗ helm template coder . --version=2.27.2  --set coder.image.tag=v2.27.2 --set coder.serviceAccount.workspacePerms=true | grep -A12 -B60 RoleBinding

# Source: coder/templates/coder.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations: {}
  labels:
    app.kubernetes.io/instance: coder
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: coder
    app.kubernetes.io/part-of: coder
    app.kubernetes.io/version: 0.1.0
    helm.sh/chart: coder-0.1.0
  name: coder
  namespace: default
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: coder-workspace-perms
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: "coder"
  namespace: default
subjects:
  - kind: ServiceAccount
    name: "coder"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: coder-workspace-perms
---
# Source: coder/templates/service.yaml

Update with workspacePerms=false and workspaceNamespaces populated:

➜  coder git:(rowan/helm_rbac_fix) ✗ helm template coder . --version=2.27.2  --set coder.image.tag=v2.27.2 --set coder.serviceAccount.workspacePerms=false --set-json 'coder.serviceAccount.workspaceNamespaces=[{"name":"dev-ws","workspacePerms":true,"enableDeployments":true,"extraRules":[]}]' | grep -A15 -B105 RoleBinding
---
# Source: coder/templates/coder.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations: {}
  labels:
    app.kubernetes.io/instance: coder
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: coder
    app.kubernetes.io/part-of: coder
    app.kubernetes.io/version: 0.1.0
    helm.sh/chart: coder-0.1.0
  name: coder
  namespace: default
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: coder-workspace-perms
  namespace: dev-ws
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: "coder"
  namespace: dev-ws
subjects:
  - kind: ServiceAccount
    name: "coder"
    namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: coder-workspace-perms
---
# Source: coder/templates/service.yaml
apiVersion: v1
kind: Service

Update with workspacePerms=true and workspaceNamespaces populated:

➜  coder git:(rowan/helm_rbac_fix) ✗ helm template coder . --version=2.27.2  --set coder.image.tag=v2.27.2 --set coder.serviceAccount.workspacePerms=true --set-json 'coder.serviceAccount.workspaceNamespaces=[{"name":"dev-ws","workspacePerms":true,"enableDeployments":true,"extraRules":[]}]' | grep -A15 -B105 RoleBinding             
---
# Source: coder/templates/coder.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations: {}
  labels:
    app.kubernetes.io/instance: coder
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: coder
    app.kubernetes.io/part-of: coder
    app.kubernetes.io/version: 0.1.0
    helm.sh/chart: coder-0.1.0
  name: coder
  namespace: default
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: coder-workspace-perms
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: coder-workspace-perms
  namespace: dev-ws
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: "coder"
  namespace: default
subjects:
  - kind: ServiceAccount
    name: "coder"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: coder-workspace-perms
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: "coder"
  namespace: dev-ws
subjects:
  - kind: ServiceAccount
    name: "coder"
    namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: coder-workspace-perms
---
# Source: coder/templates/service.yaml
apiVersion: v1
kind: Service
➜  coder git:(rowan/helm_rbac_fix) ✗

@rowansmithau rowansmithau self-assigned this Oct 30, 2025
@rowansmithau rowansmithau added the helm Area: helm chart label Oct 30, 2025
@rowansmithau rowansmithau changed the title bug: fix on Helm chart for workspacePerms=false incorrectly rendering RBAC when it should not fix: fix incorrect rendering of RBAC in Helm chart when workspacePerms=false Oct 30, 2025
@rowansmithau rowansmithau marked this pull request as ready for review October 30, 2025 01:11
@rowansmithau rowansmithau merged commit 30d2fc8 into main Oct 30, 2025
32 checks passed
@rowansmithau rowansmithau deleted the rowan/helm_rbac_fix branch October 30, 2025 18:22
@github-actions github-actions bot locked and limited conversation to collaborators Oct 30, 2025
@stirby stirby added cherry-pick/v2.28 Needs to be cherry-picked to the 2.28 release branch helm Area: helm chart cherry-pick/v2.27 Items to be pulled in for the v2.27 release. and removed helm Area: helm chart labels Oct 30, 2025
@david-fraley
Copy link
Collaborator

david-fraley commented Oct 30, 2025

/cherry-pick release/2.27

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@deansheather deansheather deansheather approved these changes

Assignees

@rowansmithau rowansmithau

Labels

cherry-pick/v2.27 Items to be pulled in for the v2.27 release. cherry-pick/v2.28 Needs to be cherry-picked to the 2.28 release branch helm Area: helm chart

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

bug: Helm chart (v2.27 and up) inadvertently rendering roles and rolebindings although coder.serviceAccount.workspacePerms is set to false

5 participants

@rowansmithau @david-fraley @deansheather @stirby