<p>I want to run a pre-install helm hook.</p>
<p>This will run a job that will be using custom image whose entrypoint will be executing the following command</p>
<pre><code>kubectl create secret generic my-secret --from-literal=foo=bar
</code></pre>
<p>Can this action be permitted via RBAC?</p>
<p>If so, what are the minimal permissions that need to be given to the specific pod / job to carry this task out?</p>

pkaramol
<p>This is <em>possible</em> but maybe not the simplest thing.</p>
<p>You can use the standard <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes RBAC system</a> to allow this, with a role like</p>
<pre class="lang-yaml prettyprint-override"><code># templates/pre-install-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include &quot;chart.name&quot; . }}-pre-install
  annotations:
    helm.sh/hook: pre-install
rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;secrets&quot;]
    verbs: [&quot;create&quot;]
</code></pre>
<p>However, that Role needs to be attached to something to have an effect, which means you also need to create a ServiceAccount, and a RoleBinding to attach the two together:</p>
<pre class="lang-yaml prettyprint-override"><code># templates/pre-install-service-account.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include &quot;chart.name&quot; . }}-pre-install
  annotations:
    helm.sh/hook: pre-install
</code></pre>
<pre><code># templates/pre-install-service-role-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include &quot;chart.name&quot; . }}-pre-install
  annotations:
    helm.sh/hook: pre-install
subjects:
  - kind: ServiceAccount
    namespace: {{ .Release.Namespace }}
    name: {{ include &quot;chart.name&quot; . }}-pre-install
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include &quot;chart.name&quot; . }}-pre-install
</code></pre>
<p>And, finally, in your pre-install Job, you need to reference</p>
<pre class="lang-yaml prettyprint-override"><code>serviceAccountName: {{ include &quot;chart.name&quot; . }}-pre-install
</code></pre>
<p>Note that Helm pre-install hooks run, well, before anything else is installed, which means that where we need these auxiliary authorization-related objects to run the hook, they also need to be labeled as pre-install hooks.  With the default <a href="https://docs.helm.sh/docs/topics/charts_hooks/#hook-deletion-policies" rel="nofollow noreferrer">deletion policy</a> they will stay installed until the chart is uninstalled.</p>
<p>You may find it simpler to just create the Secret in your Helm chart, if you'll have the required data at deployment time.</p>
