fix(alloy): narrow the collector RBAC to required permissions

CHANGELOG.md

@@ -5,6 +5,7 @@
 - BREAKING: replaces the `grafana-agent` subchart with Grafana Alloy (`alloy` chart 1.13.1). Rename any `grafana-agent:` values overrides to `alloy:`.
 - Pod `job` label changes from `<ns>/grafana-agent/grafana-agent` to `<ns>/alloy/alloy`; update queries and alerts that match the old label.
 - Alloy listens on port 12345 instead of 80.
+- Alloy `ClusterRole` is narrowed to `pods`, `nodes` and `nodes/metrics`. It no longer grants read access to `secrets` and `configmaps`. If you add components through `alloy.extraBlocks` that need more access, override `alloy.rbac.rules` and `alloy.rbac.clusterRules`.
 
 ## v0.3.0
 

README.md

@@ -328,6 +328,19 @@ values which are defined [here](https://github.com/grafana/helm-charts/tree/main
 | alloy.fullnameOverride | string | `"alloy"` |  |
 | alloy.podLogsRelabelRules | string | `""` |  |
 | alloy.podMetricsRelabelRules | string | `""` |  |
+| alloy.rbac.clusterRules[0].apiGroups[0] | string | `""` |  |
+| alloy.rbac.clusterRules[0].resources[0] | string | `"nodes"` |  |
+| alloy.rbac.clusterRules[0].verbs[0] | string | `"get"` |  |
+| alloy.rbac.clusterRules[0].verbs[1] | string | `"list"` |  |
+| alloy.rbac.clusterRules[0].verbs[2] | string | `"watch"` |  |
+| alloy.rbac.clusterRules[1].apiGroups[0] | string | `""` |  |
+| alloy.rbac.clusterRules[1].resources[0] | string | `"nodes/metrics"` |  |
+| alloy.rbac.clusterRules[1].verbs[0] | string | `"get"` |  |
+| alloy.rbac.rules[0].apiGroups[0] | string | `""` |  |
+| alloy.rbac.rules[0].resources[0] | string | `"pods"` |  |
+| alloy.rbac.rules[0].verbs[0] | string | `"get"` |  |
+| alloy.rbac.rules[0].verbs[1] | string | `"list"` |  |
+| alloy.rbac.rules[0].verbs[2] | string | `"watch"` |  |
 | alloy.withOTLPReceiver | bool | `false` |  |
 | global.alerts.enabled | bool | `true` | enable or disable alerting |
 | global.alerts.kind | string | `"configmap"` | the container resource kind in which alerts should be created; valid values are "prometheusrule" or "configmap" |

coder-observability/values.yaml

@@ -213,6 +213,22 @@ alloy:
       prometheus.io/scrape: "true"
   crds:
     create: false
+  # Only the permissions that the collector config uses: pod and node discovery,
+  # and the kubelet cAdvisor scrape. The subchart defaults also grant cluster-wide
+  # read access to secrets and configmaps. If you add components through
+  # extraBlocks that need more, override these lists.
+  rbac:
+    rules:
+      - apiGroups: [""]
+        resources: ["pods"]
+        verbs: ["get", "list", "watch"]
+    clusterRules:
+      - apiGroups: [""]
+        resources: ["nodes"]
+        verbs: ["get", "list", "watch"]
+      - apiGroups: [""]
+        resources: ["nodes/metrics"]
+        verbs: ["get"]
 
   withOTLPReceiver: false
 

compiled/resources.yaml

@@ -10980,87 +10980,10 @@ metadata:
     app.kubernetes.io/part-of: alloy
     app.kubernetes.io/component: rbac
 rules:
-  - apiGroups:
-      - ""
-      - discovery.k8s.io
-      - networking.k8s.io
-    resources:
-      - endpoints
-      - endpointslices
-      - ingresses
-      - pods
-      - services
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - ""
     resources:
       - pods
-      - pods/log
-      - namespaces
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - monitoring.grafana.com
-    resources:
-      - podlogs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - prometheusrules
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - alertmanagerconfigs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - podmonitors
-      - servicemonitors
-      - probes
-      - scrapeconfigs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - apps
-      - extensions
-    resources:
-      - replicasets
     verbs:
       - get
       - list
@@ -11073,26 +10996,12 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - ""
-    resources:
-      - nodes/pods
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - ""
     resources:
       - nodes/metrics
     verbs:
       - get
-      - list
-      - watch
-  - nonResourceURLs:
-      - /metrics
-    verbs:
-      - get
 ---
 # Source: coder-observability/charts/grafana/templates/clusterrole.yaml
 kind: ClusterRole