Volodymyr Stoiko dba8867fb5 helm: kubeshark-cli ServiceAccount + token-minter RBAC + allowlist (phase 2a) ...

When tap.auth.cli.enabled, create the kubeshark-cli ServiceAccount and a
Role granting 'create' on serviceaccounts/token for it (bound to
configurable tap.auth.cli.subjects), and set AUTH_CLI_SERVICE_ACCOUNTS so
the Hub allowlists it. Binding the Role to a subject is what grants that
subject CLI access to a gated Hub.

2026-06-15 21:57:28 +00:00

6.5 KiB

Raw Permalink Blame History

View Raw