This repository has been archived by the owner on May 6, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 385
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
RBAC setup behind the aggregator. (#936)
* RBAC - RBAC in chart - add the ServiceAccount definitions to chart - parameterize namespace and ServiceAccount names Thanks to - liggitt for helping me with discovering RBAC rules. - DirectXMan12 for helping me troubleshoot aggregator setup. * add RBAC setup to Jenkins cluster initialization
- Loading branch information
1 parent
0864a2e
commit 8ec0874
Showing
6 changed files
with
167 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,141 @@ | ||
{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1beta1" }} | ||
apiVersion: v1 | ||
kind: List | ||
items: | ||
|
||
### API Server ### | ||
|
||
# TODO: if this is just for namespace lifecycle admission, move to a generic role | ||
# the role for the apiserver | ||
- apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
kind: ClusterRole | ||
metadata: | ||
name: "servicecatalog.k8s.io:apiserver" | ||
# this rule defined on the role for specifically the | ||
# namespace-lifecycle admission-controller | ||
rules: | ||
- apiGroups: [""] | ||
resources: ["namespaces"] | ||
verbs: ["get", "list", "watch"] | ||
# API-server service-account gets its own role | ||
- apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
kind: ClusterRoleBinding | ||
metadata: | ||
name: "servicecatalog.k8s.io:apiserver" | ||
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: ClusterRole | ||
name: "servicecatalog.k8s.io:apiserver" | ||
subjects: | ||
- apiGroup: "" | ||
kind: ServiceAccount | ||
name: "{{ .Values.apiserver.serviceAccount }}" | ||
namespace: "{{ .Release.Namespace }}" | ||
# apiserver gets the auth-delegator role to delegate auth decisions to | ||
# the core apiserver | ||
- apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
kind: ClusterRoleBinding | ||
metadata: | ||
name: "servicecatalog.k8s.io:apiserver-auth-delegator" | ||
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: ClusterRole | ||
name: system:auth-delegator | ||
subjects: | ||
- apiGroup: "" | ||
kind: ServiceAccount | ||
name: "{{ .Values.apiserver.serviceAccount }}" | ||
namespace: "{{ .Release.Namespace }}" | ||
# apiserver gets the ability to read authentication. This allows it to | ||
# read the specific configmap that has the requestheader-* entries to | ||
# enable api aggregation | ||
- apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
kind: RoleBinding | ||
metadata: | ||
name: "servicecatalog.k8s.io:apiserver-authentication-reader" | ||
namespace: kube-system | ||
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: Role | ||
name: extension-apiserver-authentication-reader | ||
subjects: | ||
- apiGroup: "" | ||
kind: ServiceAccount | ||
name: "{{ .Values.apiserver.serviceAccount }}" | ||
namespace: "{{ .Release.Namespace }}" | ||
|
||
### Controller-Manager ### | ||
|
||
# controller-manager role defines what access the service-catalog | ||
# controller-manager needs to manage the resources of the | ||
# service-catalog | ||
- apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
kind: ClusterRole | ||
metadata: | ||
name: "servicecatalog.k8s.io:controller-manager" | ||
rules: | ||
- apiGroups: [""] | ||
resources: ["events"] | ||
verbs: ["create","patch","update"] | ||
# TODO: do not grant global access, limit to particular secrets referenced from bindings | ||
- apiGroups: [""] | ||
resources: ["secrets"] | ||
verbs: ["get","create","delete"] | ||
- apiGroups: [""] | ||
resources: ["namespaces"] | ||
verbs: ["get","list","watch"] | ||
# access to our service-catalog types | ||
- apiGroups: ["servicecatalog.k8s.io"] | ||
resources: ["serviceclasses"] | ||
verbs: ["get","list","watch","create","patch","update","delete"] | ||
- apiGroups: ["servicecatalog.k8s.io"] | ||
resources: ["bindings","brokers","instances"] | ||
verbs: ["get","list","watch"] | ||
- apiGroups: ["servicecatalog.k8s.io"] | ||
resources: ["bindings/status","brokers/status","instances/status"] | ||
verbs: ["update"] | ||
# give the controller-manager service account access to whats defined in its role. | ||
- apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
kind: ClusterRoleBinding | ||
metadata: | ||
name: "servicecatalog.k8s.io:controller-manager" | ||
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: ClusterRole | ||
name: "servicecatalog.k8s.io:controller-manager" | ||
subjects: | ||
- apiGroup: "" | ||
kind: ServiceAccount | ||
name: "{{ .Values.controllerManager.serviceAccount }}" | ||
namespace: "{{ .Release.Namespace }}" | ||
|
||
# This gives create/update access to an endpoint in kube-system for leader election | ||
# TODO: use an object other than endpoints, and in the same namespace as the service catalog, not in kube-system | ||
- apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
kind: Role | ||
metadata: | ||
name: "servicecatalog.k8s.io::leader-locking-controller-manager" | ||
namespace: kube-system | ||
rules: | ||
- apiGroups: [""] | ||
resources: ["endpoints"] | ||
verbs: ["create"] | ||
- apiGroups: [""] | ||
resources: ["endpoints"] | ||
resourceNames: ["service-catalog-controller-manager"] | ||
verbs: ["get","update"] | ||
- apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
kind: RoleBinding | ||
metadata: | ||
name: service-catalog-controller-manager | ||
namespace: kube-system | ||
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: Role | ||
name: service-catalog-controller-manager | ||
subjects: | ||
- apiGroup: "" | ||
kind: ServiceAccount | ||
name: "{{ .Values.controllerManager.serviceAccount }}" | ||
namespace: "{{ .Release.Namespace }}" | ||
{{ end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
apiVersion: v1 | ||
kind: List | ||
items: | ||
# The SA for the apiserver | ||
- apiVersion: v1 | ||
kind: ServiceAccount | ||
metadata: | ||
name: "{{ .Values.apiserver.serviceAccount }}" | ||
# The SA for the controller-manager | ||
- apiVersion: v1 | ||
kind: ServiceAccount | ||
metadata: | ||
name: "{{ .Values.controllerManager.serviceAccount }}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters