From 03e9b1be78a46b801a293606ec76e83894f65a6d Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Tue, 8 Sep 2026 14:02:15 +0530 Subject: [PATCH] docs(agent): scannerAutoCopyPullSecrets now defaults to on The chart flipped the default (nudgebee/k8s-agent#603): an image scan copies the scanned pod's registry credentials for the life of the scan Job, because the node-local image copy it used to rely on is usually gone by scan time. Also corrects the read-only note. readOnly no longer fails the install when combined with auto-copy -- with the new default that would break every read-only install -- it turns auto-copy off instead. --- doc-server/docs/installation/agent/operate/helm_values.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc-server/docs/installation/agent/operate/helm_values.md b/doc-server/docs/installation/agent/operate/helm_values.md index 2591fb0d..b680ed51 100644 --- a/doc-server/docs/installation/agent/operate/helm_values.md +++ b/doc-server/docs/installation/agent/operate/helm_values.md @@ -51,7 +51,7 @@ A default install can already act on workloads: delete and evict pods, exec into | `runner.enableWritePermissions` | bool | `false` | Adds the cluster-shape permissions the default install leaves out: node delete, Service/Endpoint/ServiceAccount management, Secret update and delete, namespace create and delete, ResourceQuota and LimitRange writes, `statefulsets/scale`, workload creation, Ingress and NetworkPolicy writes, rollout lifecycle. | | `runner.readOnly` | bool | `false` | Cuts the ClusterRole down to `get`, `list`, `watch`. No Secrets access at all, no `pods/exec`, no eviction, no node patch. The few writes the agent needs to run come from a Role scoped to the release namespace. | | `runner.mutateEnabled` | bool | `true` | Turns the runner's mutating actions on or off inside the agent itself (`delete_pod`, `cordon`, `rollout_restart`, PrometheusRule CRUD, Alertmanager silences, Loki rules). With `false` they are never registered at startup, whatever RBAC allows. | -| `runner.scannerAutoCopyPullSecrets` | bool | `false` | Lets an image scan copy the scanned pod's `imagePullSecrets` into the scanner namespace so private images can be pulled. Also grants secret update, patch, and delete in the release namespace to clean the copies up afterwards. | +| `runner.scannerAutoCopyPullSecrets` | bool | `true` | Lets an image scan copy the scanned pod's `imagePullSecrets` into the release namespace, where the scan Job runs, so private images can be pulled. The copies are owned by that Job and go away with it. Also grants secret update, patch, and delete in the release namespace to clean them up. Set it to `false` and the agent never reads a registry credential — private images are then scannable only while a copy of the image is still on the node. `readOnly` forces it off. | | `runner.customClusterRoleRules` | list | `[]` | Extra rules appended to the runner ClusterRole. | | `runnerServiceAccount.imagePullSecrets` | list | `[]` | Pull secrets attached to the runner ServiceAccount. | | `automountServiceAccountToken` | bool | `true` | Mount the ServiceAccount token in agent pods. | @@ -78,7 +78,7 @@ helm upgrade nudgebee-agent nudgebee-agent/nudgebee-agent \ --set runner.enableWritePermissions=true # or runner.readOnly=true ``` -`readOnly` cannot be combined with `enableWritePermissions` or `scannerAutoCopyPullSecrets`. The install fails if you set both. +`readOnly` cannot be combined with `enableWritePermissions`. The install fails if you set both. It also turns `scannerAutoCopyPullSecrets` off — that path has to read Secrets in workload namespaces, which read-only mode does not allow. Under `readOnly` the rightsizing recommendations still compute; you just cannot apply them from the UI. If your security review needs to see the exact permissions first, the whole read-only ClusterRole is in one file: [`runner-service-account-readonly.yaml`](https://github.com/nudgebee/k8s-agent/blob/main/charts/nudgebee-agent/templates/runner-service-account-readonly.yaml).