Restrict SealedSecrets RoleBinding to ServiceAccount

The original work by @bartsmykla had the unfortunate effect of
granting CREATE / GET and UPDATE to every Deployment in the
openfaas-fn namespace including user functions.

This commit ties that down to just functions which have a specific
ServiceAccount set of sealedsecrets-importer-rw. Tested on DOKS
with a sample user function which worked before and got access
denied after.

Signed-off-by: Alex Ellis <alexellis2@gmail.com>

Author: alexellis

docs/README.md

@@ -669,6 +669,14 @@ kubeseal --fetch-cert > pub-cert.pem
 
 You will need to distribute or share pub-cert.pem so that people can use this with the OpenFaaS CLI `faas-cli cloud seal` command to seal secrets.
 
+* Patch the service account for the `import-secrets` function
+
+This `ServiceAccount` needs to be patched in place so that the function can perform create / get and update on the SealedSecret CRD:
+
+```sh
+kubectl patch -n openfaas-fn deploy import-secrets -p '{"spec":{"template":{"spec":{"serviceAccountName":"sealedsecrets-importer-rw"}}}}'
+```
+
 ### Custom templates
 
 You can add your own custom templates by re-deploying the `git-tar` function in `stack.yml`.

yaml/core/import-secrets-role.yml

@@ -0,0 +1,31 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: sealedsecrets-importer
+rules:
+- apiGroups: ["bitnami.com"]
+  resources: ["sealedsecrets"]
+  verbs: ["get", "create", "update"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: manage-sealed-secrets
+  namespace: openfaas-fn
+subjects:
+- kind: ServiceAccount
+  name: sealedsecrets-importer-rw
+  namespace: openfaas-fn
+roleRef:
+  kind: ClusterRole
+  name: sealedsecrets-importer
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sealedsecrets-importer-rw
+  namespace: openfaas-fn
+  labels:
+    app: openfaas
+#kubectl patch -n openfaas-fn deploy import-secrets -p '{"spec":{"template":{"spec":{"serviceAccountName":"sealedsecrets-importer-rw"}}}}'