Access only to reconcile, suspend, resume helmrelease

[sov-msaeed]

I want to let users in production trigger reconcile / suspend / resume on HelmReleases via the Flux CLI, without letting them modify the HelmRelease spec (e.g. patch spec.values via kubectl or flux CLI).

From what I understand, all three actions go through a PATCH on the HelmRelease (annotation bump for reconcile, spec.suspend for suspend/resume), so granting patch on helmreleases is required.

Is that understanding correct? Is there a Flux-native way to allow these three actions only ?

[matheuscscp]

You can do that through the Flux Operator Web UI:

https://fluxoperator.dev/docs/web-ui/user-management/#flux-web-admin-role

[stefanprodan]

Why would the role bindings for the Web UI be used for kubectl? The Web UI comes with its own roles, you would bind those to the users groups extracted from the JWT claims.

[sov-msaeed]

I didn't mean to use the one for the webui. https://fluxoperator.dev/docs/web-ui/user-management/#role-based-access-control based in this, the webui will still need the user to have RBAC, not clear to me which permissions then the Role of the user needs to be able only to reconcile ? get, list, and watch would be enough ?

[matheuscscp]

Unfortunately, it would still need patch at the moment...

[matheuscscp]

@sov-msaeed We added this feature for you, will be shipped in the next Flux Operator version: controlplaneio-fluxcd/flux-operator#882

[sov-msaeed]

@matheuscscp That's great thank you so much. I will ask for more 😄 would it be possible to apply the same concept not only using the UI but also using any underline tooling ? we are now using headlamp plugin and flux operator cli to perform flux operations, it would be more maintenance for us to support another UI, that's why i am asking.

[matheuscscp]

Unfortunately we don't control access for anything else... The Web UI is the only application that runs with privileged RBAC inside the cluster that can expose custom operations on top of the Kubernetes API Server that we control. If you really need this kind of fine-grained access I would recommend switching from Headlamp altogether to maintain one less tool. Our goal with the Web UI is to make it useful for both devs and platform team, so any issues/feature requests are welcome on that regard. We are close to shipping a dedicated workload dashboard there.