Limit kubectl commands

[IngussNeilands]

I would like to suggest adding option to limit specific kubectl commands.

For example - I would like to disable describe secret command, because it could reveal some sensitive data.

[PrasadG193]

@IngussNeilands we can restrict BotKube to access only specific resources by adding rules to in Clusterrole which is used by botkube-sa service account
https://github.com/infracloudio/botkube/blob/develop/helm/botkube/templates/clusterrole.yaml

[PrasadG193]

We are also adding a support to restrict command execution from a configured channel only #235

[cookandy]

Would it also be possible to restrict who can run kubectl commands by slack username?

[fliphess]

Using @botkube get secret <someverysecretsecret> -o yaml will result in a dataleak, I'd love to use get pods and get ns etc, but prefer to keep my passwords out of slack :)

[girishg4t]

@PrasadG193 i can take a look on this

[PrasadG193]

@girishg4t let's finalize the BotKube configuration format before you start

[PrasadG193]

The straight forward way would be to add one more section in settings.kubectl section in resource configuration. Something like:

settings:
  kubectl:
    # Set true to enable kubectl commands execution
    enabled: true
    # List of allowed commands
    commands:
      # method which are allowed
      verbs: ["get", "logs"]
      # resource configuration which is allowed
      resources: ["deployments", "pods"]

[PrasadG193]

@girishg4t let me know what you think