aws / aws/eks-charts

Remove nodes/proxy permission and use fine grained permissions like nodes/log

Open
#1,323 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Mustache
Stars
1.3k
Forks
1.1k
Avg merge
22m
Merged PRs (30d)
5

Description

**Is your feature request related to a problem?**
Now that Kubernetes v1.36 has been released and [fine-grained Kubelet API authorization](https://kubernetes.io/blog/2026/04/24/kubernetes-v1-36-fine-grained-kubelet-authorization-ga/) is GA, please switch to fine grained permissions such as `nodes/log`. This will block a [know lateral movement technique](https://grahamhelton.com/blog/nodes-proxy-rce) that could be exploited using these charts.

**Is your feature request related to a specific Helm chart, if yes mention name of the chart?**
appmesh-prometheus, cloudwatch-metrics, appmesh-spire-agent, fluent-bit

**Describe the solution you'd like**
Remove nodes/proxy permission and use fine grained permissions like nodes/log

**Describe alternatives you've considered**
N/A

Contributor guide

Open the contributing guide

Research direction

Inspect the appmesh-prometheus, cloudwatch-metrics, appmesh-spire-agent, and fluent-bit chart templates for RBAC rules granting nodes/proxy. Replace that permission with the appropriate fine-grained permissions described in the issue, then render the Helm charts and verify the generated permissions no longer include nodes/proxy.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.