-
Notifications
You must be signed in to change notification settings - Fork 211
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update composition controller RBAC #2221
Update composition controller RBAC #2221
Conversation
@@ -99,6 +96,32 @@ subjects: | |||
name: composition-controller-manager | |||
namespace: composition-system | |||
--- | |||
apiVersion: rbac.authorization.k8s.io/v1 | |||
kind: Role |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we need this to work ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
wouldnt * * * in the actual rbac be sufficient. Why do we need this ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I believe at some point the plan is to remove the * * * from the cluster role, at which point this will be necessary. I made all the changes without the superuser on the cluster role first, so I know all the tests will work as-is once that workaround is gone.
Tests all manually grant superuser permissions to the composition controller for simplicity, but that hid the fact that the controller did not have the right permissions to carry out its tasks. This change removes the broad permissions from the tests and samples and updates the controller RBAC to cover more of the requirements (while still expecting users to grant any additional permissions as necessary). As a hack to make preview smoother for customers, also globally grant superuser to the controller for the short term.
/lgtm |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: barney-s The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
2a9f592
into
GoogleCloudPlatform:master
Change description
Update composition controller RBAC
Tests all manually grant superuser permissions to the composition controller for simplicity, but that hid the fact that the controller did not have the right permissions to carry out its tasks.
This change removes the broad permissions from the tests and samples and updates the controller RBAC to cover more of the requirements (while still expecting users to grant any additional permissions as necessary).
As a hack to make preview smoother for customers, globally grant superuser to the controller for the short term.