Remove nodes/proxy permission and use fine grained permissions like nodes/log
- Dominant language
- Mustache
- Stars
- 1.3k
- Forks
- 1.1k
- Avg merge
- 22m
- Merged PRs (30d)
- 5
Description
**Is your feature request related to a problem?**
Now that Kubernetes v1.36 has been released and [fine-grained Kubelet API authorization](https://kubernetes.io/blog/2026/04/24/kubernetes-v1-36-fine-grained-kubelet-authorization-ga/) is GA, please switch to fine grained permissions such as `nodes/log`. This will block a [know lateral movement technique](https://grahamhelton.com/blog/nodes-proxy-rce) that could be exploited using these charts.
**Is your feature request related to a specific Helm chart, if yes mention name of the chart?**
appmesh-prometheus, cloudwatch-metrics, appmesh-spire-agent, fluent-bit
**Describe the solution you'd like**
Remove nodes/proxy permission and use fine grained permissions like nodes/log
**Describe alternatives you've considered**
N/A
Contributor guide
Research direction
Inspect the appmesh-prometheus, cloudwatch-metrics, appmesh-spire-agent, and fluent-bit chart templates for RBAC rules granting nodes/proxy. Replace that permission with the appropriate fine-grained permissions described in the issue, then render the Helm charts and verify the generated permissions no longer include nodes/proxy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100