From 6fd0bcf1d7405985ca18bab13ec25c4f566d687c Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Fri, 25 Sep 2026 23:46:07 +0000 Subject: [PATCH] feat(paperclip): let the read-only proxy grant reach Alertmanager (REN-95) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Appends one `resourceNames` entry to the existing `paperclip-prometheus-read` Role so the read-only apiserver service-proxy path also covers Alertmanager: kube-prometheus-stack-alertmanager:9093 This is the widening that the file's own header comment said required a new card and a new review — REN-94/REN-95 are that card, and Hermes confirmed the target against the live cluster before this was written. Nothing else about the grant changes. Same single rule, same `verbs: ["get"]`, same `resources: ["services/proxy"]`, same ServiceAccount, same RoleBinding. No new rule, no cluster-scoped kind, no second verb. `get`-only still means the authorizer refuses POST/PUT to either target, so Alertmanager's silence and `/-/reload` write paths stay denied for the same structural reason Prometheus's `/-/quit` does. No NetworkPolicy edit: `network-policy.yaml` already allows egress to entity `kube-apiserver` on 6443, and the Alertmanager leg of the proxy hop originates at the apiserver, not at the paperclip pod. Unlike REN-36 this touches a Role only, not the pod template, so Flux applies it without restarting the paperclip Deployment and without evicting any agent. Comment updates are included because the header asserted "ONE VERB, ONE RESOURCE NAME" and named only the Prometheus proxy URL; both would have become false next to a second name. Revert: revert this one commit. The grant returns to Prometheus-only and no workload restarts. Co-Authored-By: Paperclip Co-Authored-By: Claude Opus 5 --- .../apps/paperclip/prometheus-read-rbac.yaml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/kubernetes/apps/paperclip/prometheus-read-rbac.yaml b/kubernetes/apps/paperclip/prometheus-read-rbac.yaml index 3a2a401e..10d67880 100644 --- a/kubernetes/apps/paperclip/prometheus-read-rbac.yaml +++ b/kubernetes/apps/paperclip/prometheus-read-rbac.yaml @@ -20,16 +20,19 @@ # `ci-diagnostics-service-proxy` Role), which has run this same path for the # alert-monitor since 2026-07-16. # -# ONE VERB, ONE RESOURCE NAME — ON PURPOSE +# ONE VERB, NAMED SERVICES ONLY — ON PURPOSE # # Every process in the paperclip pod can read the mounted ServiceAccount token, -# so the token is only worth what this Role grants. It grants `get` on one -# Service. Widening it is a new card and a new review, not an edit here. +# so the token is only worth what this Role grants. It grants `get` on the two +# Services named below and nothing else. Widening it is a new card and a new +# review, not an edit here — the Alertmanager name was added that way (REN-95, +# for read-only alert-delivery checks; parent REN-94). # # `resourceNames` is matched verbatim by the authorizer, not as a selector: # `svc`, `svc:9090` and `http:svc:9090` are three different strings. Only the -# port-qualified form is granted, so the one URL that works is +# port-qualified forms are granted, so the only URLs that work are # /api/v1/namespaces/monitoring/services/kube-prometheus-stack-prometheus:9090/proxy/... +# /api/v1/namespaces/monitoring/services/kube-prometheus-stack-alertmanager:9093/proxy/... # A 403 on some other form is the grant working. Do not fix it by adding a # string. apiVersion: v1 @@ -42,6 +45,11 @@ metadata: # Named for the only thing it is worth. If a future change gives this account a # second grant, the name is a lie and the review should say so. Whether the # token is mounted is decided on the pod (`paperclip.yaml`), not here. +# +# REN-95 stretched the name: it now also proxies to Alertmanager. Kept as-is +# deliberately — `serviceAccountName` is in the pod template, so renaming it +# would restart the paperclip Deployment and evict running agents. Read the name +# as "read-only kube-prometheus-stack access", and read the Role for the truth. --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -56,6 +64,7 @@ rules: verbs: ["get"] resourceNames: - "kube-prometheus-stack-prometheus:9090" + - "kube-prometheus-stack-alertmanager:9093" --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding