feat: customizable RBAC templates by sleeyax · Pull Request #563 · yonahd/kor

sleeyax · 2026-01-28T21:23:29Z

What this PR does / why we need it?

This pull request refactors how RBAC resources are generated in the Helm chart, making the configuration more flexible for consumers of the chart.

See the linked issue for more context. For my use-case I can now install kor in our permission-limited cluster with the following config:

rbac:
    create: 'role'
    rules:
      - apiGroups:
          - ''
        resources:
          - secrets
          - persistentvolumeclaims
          - pods
        verbs:
          - get
          - list
          - watch
          - delete
      - apiGroups:
          - networking.k8s.io
        resources:
          - ingresses
        verbs:
          - get
          - list
          - watch

$ helm upgrade --install kor-test helm --set kor.enabled=true --set "kor.cronJob.args={pvc\,secret,--delete,--no-interactive,--include-namespaces=development,--skip-namespace-validation}"

PR Checklist

This PR modifies the helm chart

GitHub Issue

Closes #561

Notes for reviewers

Sorry for the messy commits. Took a bit of trial and error to land on a solution I'm satisfied with. Probably best to squash these changes.

…source rules (closes yonahd#561)

…role creation

codecov-commenter · 2026-01-29T09:15:54Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.56%. Comparing base (58fc28d) to head (d0b99f0).
⚠️ Report is 1 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #563   +/-   ##
=======================================
  Coverage   46.56%   46.56%           
=======================================
  Files          69       69           
  Lines        3930     3930           
=======================================
  Hits         1830     1830           
  Misses       1794     1794           
  Partials      306      306

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

yonahd · 2026-01-30T06:08:57Z

@sleeyax
Please run

docker run --rm --volume "$(pwd):/helm-docs" -u $(id -u) jnorwood/helm-docs:latest

To generate the Readme

sleeyax · 2026-02-03T16:04:50Z

@sleeyax Please run
docker run --rm --volume "$(pwd):/helm-docs" -u $(id -u) jnorwood/helm-docs:latest 
To generate the Readme

done.

cmd/kor/root.go

yonahd · 2026-02-12T21:27:02Z

@sleeyax can you fix the chart and pull the namespacing code to a separate pr?

sleeyax · 2026-02-13T18:59:40Z

@yonahd Sure. I'll pick this back up next week.

This commit changes from flat list configs to an array of rules.

yonahd

Looks good overall
One comment

charts/kor/values.yaml

Copilot

Pull request overview

This pull request refactors the Helm chart's RBAC resource generation to make it more flexible and customizable. It addresses issue #561, which requested the ability to customize ClusterRole resources for permission-limited clusters.

Changes:

Adds configurable RBAC generation with rbac.create field supporting multiple modes (true/false/"role"/"clusterrole")
Introduces customizable rbac.rules array allowing users to define their own RBAC permissions
Replaces hardcoded RBAC rules with proper API group to resource mappings, removing the overly permissive wildcard apiGroups: ["*"] pattern

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
charts/kor/values.yaml	Adds new `rbac` configuration section with `create` and `rules` fields, providing default rules with proper API group mappings for all previously supported resources
charts/kor/templates/_helpers.tpl	Adds three helper functions: `kor.createRole`, `kor.createClusterRole` for conditional resource creation, and `kor.resourceRules` for generating RBAC rules from values
charts/kor/templates/role.yaml	Refactors to use new helper functions and removes hardcoded rules, making both Role and ClusterRole conditional and rule-customizable
charts/kor/templates/rolebinding.yaml	Adds conditional rendering for RoleBinding and ClusterRoleBinding based on whether corresponding Role/ClusterRole are being created
charts/kor/Chart.yaml	Bumps chart version from 0.2.13 to 0.2.14
charts/kor/README.md	Updates documentation to reflect new version and adds documentation for new `rbac.create` and `rbac.rules` configuration options

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-23T06:26:20Z

charts/kor/templates/_helpers.tpl

+{{- $create := .Values.rbac.create -}}
+{{- if or (eq (toString $create) "true") (eq $create "role") }}true{{- end }}
+{{- end }}
+
+{{/*
+Check if ClusterRole should be created
+*/}}
+{{- define "kor.createClusterRole" -}}
+{{- $create := .Values.rbac.create -}}
+{{- if or (eq (toString $create) "true") (eq $create "clusterrole") }}true{{- end }}


The helper function doesn't handle edge cases where rbac.create is set to an unexpected value (e.g., "ClusterRole" with different casing). Consider normalizing the value using lower to be case-insensitive, or provide validation to handle unexpected values gracefully. Currently, invalid values would silently result in no RBAC resources being created, which could cause the application to fail with permission errors.

Suggested change

{{- $create := .Values.rbac.create -}}

{{- if or (eq (toString $create) "true") (eq $create "role") }}true{{- end }}

{{- end }}

{{/*

Check if ClusterRole should be created

*/}}

{{- define "kor.createClusterRole" -}}

{{- $create := .Values.rbac.create -}}

{{- if or (eq (toString $create) "true") (eq $create "clusterrole") }}true{{- end }}

{{- $create := .Values.rbac.create | toString | lower -}}

{{- if or (eq $create "true") (eq $create "role") }}true{{- end }}

{{- end }}

{{/*

Check if ClusterRole should be created

*/}}

{{- define "kor.createClusterRole" -}}

{{- $create := .Values.rbac.create | toString | lower -}}

{{- if or (eq $create "true") (eq $create "clusterrole") }}true{{- end }}

charts/kor/templates/_helpers.tpl

charts/kor/values.yaml

charts/kor/templates/_helpers.tpl

sleeyax · 2026-02-23T13:57:45Z

@yonahd Do you actually care about the comments made by copilot? Seems like it's mostly nitpicking on things. Also most of it is no longer relevant now that I implemented your suggestion.

I would appreciate a final human review more.

.

yonahd

Looks good to me.
Thanks for the contribution!

yonahd · 2026-02-26T21:36:42Z

@sleeyax I'd like to merge.
The Readme needs to be regenerated to pass CI

sleeyax · 2026-02-26T22:25:08Z

@sleeyax I'd like to merge.
The Readme needs to be regenerated to pass CI

You should have push permission to the branch. Otherwise I'll update it in 2 hours or so from now.

sleeyax · 2026-02-27T01:26:32Z

@yonahd I just regenerated the README.md. Hopefully the pipeline succeeds now.

sleeyax added 5 commits January 28, 2026 17:32

feat: update RBAC role and rolebinding templates with customizable re…

098d541

…source rules (closes yonahd#561)

feat: simplify RBAC configuration with customizable role and cluster …

5762513

…role creation

feat: customize RBAC apiGroups

b8e94cf

feat: simplify RBAC configuration with default resource rules

03d81ce

feat: add customizable RBAC verbs

db4c487

chore: bump chart version

5fd5b8a

sleeyax force-pushed the feat/role-customizations branch from f3d34c7 to 456de62 Compare February 2, 2026 14:27

yonahd reviewed Feb 12, 2026

View reviewed changes

cmd/kor/root.go Outdated Show resolved Hide resolved

sleeyax mentioned this pull request Feb 19, 2026

feat: add skip namespace validation option for RBAC filters #572

Open

4 tasks

sleeyax added 3 commits February 19, 2026 12:56

feat: improve RBAC configuration structure

0230e25

This commit changes from flat list configs to an array of rules.

docs: update README.md

61b3d78

chore: bump chart version

deaaac5

sleeyax force-pushed the feat/role-customizations branch from d06a92a to deaaac5 Compare February 19, 2026 11:56

sleeyax added 2 commits February 19, 2026 12:58

Merge branch 'main' into feat/role-customizations

49b238f

chore: update version badge

50fddd3

yonahd reviewed Feb 20, 2026

View reviewed changes

charts/kor/values.yaml Outdated Show resolved Hide resolved

yonahd requested a review from Copilot February 23, 2026 06:19

Copilot started reviewing on behalf of yonahd February 23, 2026 06:19 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

feat: simplify RBAC rules structure and set default verbs

7c3071f

yonahd previously approved these changes Feb 26, 2026

View reviewed changes

yonahd approved these changes Feb 26, 2026

View reviewed changes

docs: update README.md

d0b99f0

yonahd approved these changes Feb 27, 2026

View reviewed changes

yonahd merged commit 2e69ecc into yonahd:main Feb 27, 2026
2 checks passed

Conversation

sleeyax commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it?

PR Checklist

GitHub Issue

Notes for reviewers

Uh oh!

codecov-commenter commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

yonahd commented Jan 30, 2026

Uh oh!

sleeyax commented Feb 3, 2026

Uh oh!

Uh oh!

yonahd commented Feb 12, 2026

Uh oh!

sleeyax commented Feb 13, 2026

Uh oh!

yonahd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sleeyax commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yonahd left a comment

Choose a reason for hiding this comment

Uh oh!

yonahd commented Feb 26, 2026

Uh oh!

sleeyax commented Feb 26, 2026

Uh oh!

sleeyax commented Feb 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sleeyax commented Jan 28, 2026 •

edited

Loading

codecov-commenter commented Jan 29, 2026 •

edited

Loading

sleeyax commented Feb 23, 2026 •

edited

Loading