feat: add clusterAccess option for Kubernetes RBAC #18

2026-02-20T16:25:42Z

cpfarhood commented

2026-02-20 16:25:42 +00:00

(Migrated from github.com)

Summary

Adds a clusterAccess value to the Helm chart that controls what Kubernetes RBAC is provisioned for the devcontainer pod.

Value	Resources created	Access
`none` (default)	none	no cluster access
`readonlyns`	ServiceAccount + Role + RoleBinding	get/list/watch all resources in release namespace
`readwritens`	ServiceAccount + Role + RoleBinding	full access to all resources in release namespace
`readonly`	ServiceAccount + ClusterRole + ClusterRoleBinding	get/list/watch all resources cluster-wide
`readwrite`	ServiceAccount + ClusterRole + ClusterRoleBinding	full access to all resources cluster-wide

The ServiceAccount is bound to the Deployment via serviceAccountName whenever clusterAccess != none.

Usage

# values override
clusterAccess: readonlyns

Test plan

helm template with each access level renders expected resources
clusterAccess: none (default) produces no ServiceAccount/Role/Binding resources
Deploy with readonlyns — confirm pod can kubectl get pods -n <ns> but not cluster-wide
Deploy with readonly — confirm pod can kubectl get nodes
Deploy with none — confirm no cluster API access

🤖 Generated with Claude Code

## Summary Adds a `clusterAccess` value to the Helm chart that controls what Kubernetes RBAC is provisioned for the devcontainer pod. | Value | Resources created | Access | |-------|------------------|--------| | `none` (default) | none | no cluster access | | `readonlyns` | ServiceAccount + Role + RoleBinding | get/list/watch all resources in release namespace | | `readwritens` | ServiceAccount + Role + RoleBinding | full access to all resources in release namespace | | `readonly` | ServiceAccount + ClusterRole + ClusterRoleBinding | get/list/watch all resources cluster-wide | | `readwrite` | ServiceAccount + ClusterRole + ClusterRoleBinding | full access to all resources cluster-wide | The ServiceAccount is bound to the Deployment via `serviceAccountName` whenever `clusterAccess != none`. ## Usage ```yaml # values override clusterAccess: readonlyns ``` ## Test plan - [ ] `helm template` with each access level renders expected resources - [ ] `clusterAccess: none` (default) produces no ServiceAccount/Role/Binding resources - [ ] Deploy with `readonlyns` — confirm pod can `kubectl get pods -n <ns>` but not cluster-wide - [ ] Deploy with `readonly` — confirm pod can `kubectl get nodes` - [ ] Deploy with `none` — confirm no cluster API access 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: farhoodlabs/devcontainer#18