Update composition controller RBAC #2221
Conversation
| @@ -99,6 +96,32 @@ subjects: | |||
| name: composition-controller-manager | |||
| namespace: composition-system | |||
| --- | |||
| apiVersion: rbac.authorization.k8s.io/v1 | |||
| kind: Role | |||
There was a problem hiding this comment.
Do we need this to work ?
There was a problem hiding this comment.
wouldnt * * * in the actual rbac be sufficient. Why do we need this ?
There was a problem hiding this comment.
I believe at some point the plan is to remove the * * * from the cluster role, at which point this will be necessary. I made all the changes without the superuser on the cluster role first, so I know all the tests will work as-is once that workaround is gone.
Tests all manually grant superuser permissions to the composition controller for simplicity, but that hid the fact that the controller did not have the right permissions to carry out its tasks. This change removes the broad permissions from the tests and samples and updates the controller RBAC to cover more of the requirements (while still expecting users to grant any additional permissions as necessary). As a hack to make preview smoother for customers, also globally grant superuser to the controller for the short term.
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: barney-s The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
google-oss-prow
bot
merged commit 2a9f592
into
GoogleCloudPlatform:master
Change description
Update composition controller RBAC
Tests all manually grant superuser permissions to the composition controller for simplicity, but that hid the fact that the controller did not have the right permissions to carry out its tasks.
This change removes the broad permissions from the tests and samples and updates the controller RBAC to cover more of the requirements (while still expecting users to grant any additional permissions as necessary).
As a hack to make preview smoother for customers, globally grant superuser to the controller for the short term.