Skip to content

Scope configmap permission to namespace - #287

Merged
mitali-salvi merged 3 commits into
mainfrom
configmap-perm
Mar 27, 2026
Merged

Scope configmap permission to namespace#287
mitali-salvi merged 3 commits into
mainfrom
configmap-perm

Conversation

@movence

@movence movence commented Mar 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What

Removes configmaps from the cluster-wide ClusterRole and replaces it with a namespace-scoped Role + RoleBinding that grants the CloudWatch agent only what it needs:

  • create/get/upate on any configmap in amazon-cloudwatch

Why

The agent only ever creates/updates cwagent-clusterleader for leader election. Granting cluster-wide ConfigMap access was overly permissive.

Changes

  • cloudwatch-agent-clusterrole.yaml — removed configmaps rules
  • cloudwatch-agent-role.yaml — new namespace-scoped Role (create/get/update any)
  • cloudwatch-agent-rolebinding.yaml — new RoleBinding binding the Role to the agent SA

Tests Done

Validated on a test cluster. All 23 critical checks passed.

Phase Result
Install — all pods Running, leader election acquired ✅ PASS
RBAC — ClusterRole has 0 configmap rules; Role+RoleBinding correct ✅ 12/12
Container Insights — DaemonSets healthy, 2631 metrics, 4 log groups, no ConfigMap errors ✅ 6/6
App Signals — webhook injected init container + 17 OTEL env vars; ApplicationSignals metrics present ✅ 3/3 (1 warn:X-Ray traces best-effort)
Security regression — exploit replay (hostPath token theft → aws-auth access) blocked ✅ 2/2

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

sky333999
sky333999 previously approved these changes Mar 27, 2026
View reviewed changes
@mitali-salvi
mitali-salvi merged commit b12a6c5 into main Mar 27, 2026
20 checks passed
@mitali-salvi
mitali-salvi deleted the configmap-perm branch March 27, 2026 20:07
@sky333999 sky333999 mentioned this pull request Apr 7, 2026
Merged
@liustve liustve mentioned this pull request Apr 7, 2026
Merged
1 task
wangzlei pushed a commit to aws-observability/application-signals-demo that referenced this pull request Apr 7, 2026
@liustve
pin CW addon to v4.10.3-eksbuild.1 (#334)
8b3584d 
## Summary
- Pin `amazon-cloudwatch-observability` addon to `v4.10.3-eksbuild.1` in
`enable-app-signals.sh`
- v5.3.0 removed cluster-wide configmap `get` from the CW agent
ClusterRole (aws-observability/helm-charts#287), breaking the EKS
resource detector's `aws-auth` configmap lookup
- This caused all EKS E2E tests across Python and Java to fail since Apr
1 with `origin=AWS::EC2::Instance` instead of `AWS::EKS::Container`

## Test plan
- [ ] Re-run Python EKS E2E tests and confirm trace validation passes
sky333999 added a commit that referenced this pull request Apr 13, 2026
@sky333999
Revert "Scope config-map permission for cloudwatch-agent to namespace…
c56b16b 
… only (#287)"

This reverts commit b12a6c5.
sky333999 pushed a commit that referenced this pull request Apr 13, 2026
@movence @sky333999
Scope config-map permission for cloudwatch-agent to namespace only (#287
bc21430 
)

* scope configmap permission to namesapce

* integ tests

* updates
mitali-salvi added a commit that referenced this pull request Jun 10, 2026
@movence @louisall
@sky333999 @petruanica @treyrichbourg @nathalapooja @miconeilaws @mitali-salvi
Release 6.2.0 (#315)
ffea3d4 
* Add OTEL Container Insights infrastructure (#282)

* Add v6.0.0 release notes

* Cluster-scraper deployment now uses cloudwatch-agent SA (cluster-scraper SA retained as dead resource)

* Bump chart version to 6.0.1 and add release notes

* Scope config-map permission for cloudwatch-agent to namespace only (#287)

* scope configmap permission to namesapce

* integ tests

* updates

* Retain configmap get permission at cluster scope (#291)

* Fix template whitespace control and hardcoded test names

- Use {{- if instead of {{ if in cloudwatch-agent-role.yaml and
  cloudwatch-agent-rolebinding.yaml to prevent leading blank lines
- Extract agentName constant in configmap_permission_scoping_test.go
  to replace hardcoded strings

* Keep configmaps get at cluster scope, scope create/update to namespace

- Add configmaps get-only rule to ClusterRole
- Narrow namespace-scoped Role to create and update only
- Update test assertions to match

* Run integration tests on PRs targeting release-* branches

* Set hostNetwork: true for default $.agent

* Feature/ksm enrichment and label preservation (#296)

* Fix agent.config bleed-through into cluster-scraper deployment (#298)

* Fix scrapeTimeout, add missing scrape_timeout, remove dead RBAC, cleanup docs and tests (#297)

* Add ClusterIP Service for node-exporter and use service DNS for scraping (#304)

* Refactor fluent-bit region-specific (isolated) config using tpl conditionals (#271)

* Pin GitHub Actions to commit SHAs (#306)

* minor fixes (#307)

* release v6.1.0

* Add LIS CSI metrics support to OTEL container insights config (#308)

Add prometheus receiver, scope transform, attribute promote transform,
and pipeline for local instance store CSI driver metrics collection,
mirroring the existing EBS CSI pattern. Scrapes pods with label
app=ec2-instance-store-plugin in kube-system namespace and promotes
instance_id and volume_id to resource attributes.

* feat(otel): Add k8sattributes processor node filter to daemonset (#311)

* fix(integration-test): include node-exporter-service in EKS resource counts (#312)

* Add OTEL-native Container Insights log pipelines (app, host) (#310)

* release v6.2.0

* Address PR review: use v0.18 CRD schema, add version bumps to release notes

---------

Co-authored-by: Louise Allen <147041218+louisall@users.noreply.github.com>
Co-authored-by: Kaushik Surya <kausyas@amazon.com>
Co-authored-by: Kaushik Surya <108111936+sky333999@users.noreply.github.com>
Co-authored-by: Petru Anica-Popa <66786772+petruanica@users.noreply.github.com>
Co-authored-by: Trey Richbourg <63218430+treyrichbourg@users.noreply.github.com>
Co-authored-by: POOJA REDDY NATHALA <poojardy@amazon.com>
Co-authored-by: Michael O'Neill <miconeil@amazon.com>
Co-authored-by: Mitali Salvi <mitsalvi@amazon.com>
vaishnavi-30-beep pushed a commit to vaishnavi-30-beep/helm-charts that referenced this pull request Jul 2, 2026
@movence @louisall
@sky333999 @petruanica @treyrichbourg @nathalapooja @miconeilaws @mitali-salvi @vaishnavi-30-beep
Release 6.2.0 (aws-observability#315)
af35c12 
* Add OTEL Container Insights infrastructure (aws-observability#282)

* Add v6.0.0 release notes

* Cluster-scraper deployment now uses cloudwatch-agent SA (cluster-scraper SA retained as dead resource)

* Bump chart version to 6.0.1 and add release notes

* Scope config-map permission for cloudwatch-agent to namespace only (aws-observability#287)

* scope configmap permission to namesapce

* integ tests

* updates

* Retain configmap get permission at cluster scope (aws-observability#291)

* Fix template whitespace control and hardcoded test names

- Use {{- if instead of {{ if in cloudwatch-agent-role.yaml and
  cloudwatch-agent-rolebinding.yaml to prevent leading blank lines
- Extract agentName constant in configmap_permission_scoping_test.go
  to replace hardcoded strings

* Keep configmaps get at cluster scope, scope create/update to namespace

- Add configmaps get-only rule to ClusterRole
- Narrow namespace-scoped Role to create and update only
- Update test assertions to match

* Run integration tests on PRs targeting release-* branches

* Set hostNetwork: true for default $.agent

* Feature/ksm enrichment and label preservation (aws-observability#296)

* Fix agent.config bleed-through into cluster-scraper deployment (aws-observability#298)

* Fix scrapeTimeout, add missing scrape_timeout, remove dead RBAC, cleanup docs and tests (aws-observability#297)

* Add ClusterIP Service for node-exporter and use service DNS for scraping (aws-observability#304)

* Refactor fluent-bit region-specific (isolated) config using tpl conditionals (aws-observability#271)

* Pin GitHub Actions to commit SHAs (aws-observability#306)

* minor fixes (aws-observability#307)

* release v6.1.0

* Add LIS CSI metrics support to OTEL container insights config (aws-observability#308)

Add prometheus receiver, scope transform, attribute promote transform,
and pipeline for local instance store CSI driver metrics collection,
mirroring the existing EBS CSI pattern. Scrapes pods with label
app=ec2-instance-store-plugin in kube-system namespace and promotes
instance_id and volume_id to resource attributes.

* feat(otel): Add k8sattributes processor node filter to daemonset (aws-observability#311)

* fix(integration-test): include node-exporter-service in EKS resource counts (aws-observability#312)

* Add OTEL-native Container Insights log pipelines (app, host) (aws-observability#310)

* release v6.2.0

* Address PR review: use v0.18 CRD schema, add version bumps to release notes

---------

Co-authored-by: Louise Allen <147041218+louisall@users.noreply.github.com>
Co-authored-by: Kaushik Surya <kausyas@amazon.com>
Co-authored-by: Kaushik Surya <108111936+sky333999@users.noreply.github.com>
Co-authored-by: Petru Anica-Popa <66786772+petruanica@users.noreply.github.com>
Co-authored-by: Trey Richbourg <63218430+treyrichbourg@users.noreply.github.com>
Co-authored-by: POOJA REDDY NATHALA <poojardy@amazon.com>
Co-authored-by: Michael O'Neill <miconeil@amazon.com>
Co-authored-by: Mitali Salvi <mitsalvi@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mitali-salvi mitali-salvi mitali-salvi approved these changes
@sky333999 sky333999 sky333999 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@movence @mitali-salvi @sky333999