Merge pull request #2151 from estroz/bugfix/leader-election-split-rules

🐛 (go/v3) moved leases.coordination.k8s.io to its own proxy-role rule
kubernetes-sigs · Apr 19, 2021 · e6f3a70 · e6f3a70
2 parents 698ff24 + 467e672
commit e6f3a70
Show file tree

Hide file tree

Showing 15 changed files with 115 additions and 35 deletions.
diff --git a/...ns/common/kustomize/v1/scaffolds/internal/templates/config/rbac/auth_proxy_client_role.go b/...ns/common/kustomize/v1/scaffolds/internal/templates/config/rbac/auth_proxy_client_role.go
@@ -45,6 +45,8 @@ kind: ClusterRole
 metadata:
   name: metrics-reader
 rules:
-- nonResourceURLs: ["/metrics"]
-  verbs: ["get"]
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
 `
diff --git a/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/rbac/auth_proxy_role.go b/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/rbac/auth_proxy_role.go
@@ -45,12 +45,16 @@ kind: ClusterRole
 metadata:
   name: proxy-role
 rules:
-- apiGroups: ["authentication.k8s.io"]
+- apiGroups:
+  - authentication.k8s.io
   resources:
   - tokenreviews
-  verbs: ["create"]
-- apiGroups: ["authorization.k8s.io"]
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
   resources:
   - subjectaccessreviews
-  verbs: ["create"]
+  verbs:
+  - create
 `
diff --git a/...gins/common/kustomize/v1/scaffolds/internal/templates/config/rbac/leader_election_role.go b/...gins/common/kustomize/v1/scaffolds/internal/templates/config/rbac/leader_election_role.go
@@ -48,9 +48,19 @@ metadata:
 rules:
 - apiGroups:
   - ""
-  - coordination.k8s.io
   resources:
   - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
   - leases
   verbs:
   - get

diff --git a/testdata/project-v3-addon/config/rbac/auth_proxy_client_clusterrole.yaml b/testdata/project-v3-addon/config/rbac/auth_proxy_client_clusterrole.yaml
@@ -3,5 +3,7 @@ kind: ClusterRole
 metadata:
   name: metrics-reader
 rules:
-- nonResourceURLs: ["/metrics"]
-  verbs: ["get"]
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
diff --git a/testdata/project-v3-addon/config/rbac/auth_proxy_role.yaml b/testdata/project-v3-addon/config/rbac/auth_proxy_role.yaml
@@ -3,11 +3,15 @@ kind: ClusterRole
 metadata:
   name: proxy-role
 rules:
-- apiGroups: ["authentication.k8s.io"]
+- apiGroups:
+  - authentication.k8s.io
   resources:
   - tokenreviews
-  verbs: ["create"]
-- apiGroups: ["authorization.k8s.io"]
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
   resources:
   - subjectaccessreviews
-  verbs: ["create"]
+  verbs:
+  - create
diff --git a/testdata/project-v3-addon/config/rbac/leader_election_role.yaml b/testdata/project-v3-addon/config/rbac/leader_election_role.yaml
@@ -6,9 +6,19 @@ metadata:
 rules:
 - apiGroups:
   - ""
-  - coordination.k8s.io
   resources:
   - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
   - leases
   verbs:
   - get

diff --git a/testdata/project-v3-config/config/rbac/auth_proxy_client_clusterrole.yaml b/testdata/project-v3-config/config/rbac/auth_proxy_client_clusterrole.yaml
@@ -3,5 +3,7 @@ kind: ClusterRole
 metadata:
   name: metrics-reader
 rules:
-- nonResourceURLs: ["/metrics"]
-  verbs: ["get"]
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
diff --git a/testdata/project-v3-config/config/rbac/auth_proxy_role.yaml b/testdata/project-v3-config/config/rbac/auth_proxy_role.yaml
@@ -3,11 +3,15 @@ kind: ClusterRole
 metadata:
   name: proxy-role
 rules:
-- apiGroups: ["authentication.k8s.io"]
+- apiGroups:
+  - authentication.k8s.io
   resources:
   - tokenreviews
-  verbs: ["create"]
-- apiGroups: ["authorization.k8s.io"]
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
   resources:
   - subjectaccessreviews
-  verbs: ["create"]
+  verbs:
+  - create
diff --git a/testdata/project-v3-config/config/rbac/leader_election_role.yaml b/testdata/project-v3-config/config/rbac/leader_election_role.yaml
@@ -6,9 +6,19 @@ metadata:
 rules:
 - apiGroups:
   - ""
-  - coordination.k8s.io
   resources:
   - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
   - leases
   verbs:
   - get

diff --git a/testdata/project-v3-multigroup/config/rbac/auth_proxy_client_clusterrole.yaml b/testdata/project-v3-multigroup/config/rbac/auth_proxy_client_clusterrole.yaml
@@ -3,5 +3,7 @@ kind: ClusterRole
 metadata:
   name: metrics-reader
 rules:
-- nonResourceURLs: ["/metrics"]
-  verbs: ["get"]
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
diff --git a/testdata/project-v3-multigroup/config/rbac/auth_proxy_role.yaml b/testdata/project-v3-multigroup/config/rbac/auth_proxy_role.yaml
@@ -3,11 +3,15 @@ kind: ClusterRole
 metadata:
   name: proxy-role
 rules:
-- apiGroups: ["authentication.k8s.io"]
+- apiGroups:
+  - authentication.k8s.io
   resources:
   - tokenreviews
-  verbs: ["create"]
-- apiGroups: ["authorization.k8s.io"]
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
   resources:
   - subjectaccessreviews
-  verbs: ["create"]
+  verbs:
+  - create
diff --git a/testdata/project-v3-multigroup/config/rbac/leader_election_role.yaml b/testdata/project-v3-multigroup/config/rbac/leader_election_role.yaml
@@ -6,9 +6,19 @@ metadata:
 rules:
 - apiGroups:
   - ""
-  - coordination.k8s.io
   resources:
   - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
   - leases
   verbs:
   - get

diff --git a/testdata/project-v3/config/rbac/auth_proxy_client_clusterrole.yaml b/testdata/project-v3/config/rbac/auth_proxy_client_clusterrole.yaml
@@ -3,5 +3,7 @@ kind: ClusterRole
 metadata:
   name: metrics-reader
 rules:
-- nonResourceURLs: ["/metrics"]
-  verbs: ["get"]
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
diff --git a/testdata/project-v3/config/rbac/auth_proxy_role.yaml b/testdata/project-v3/config/rbac/auth_proxy_role.yaml
@@ -3,11 +3,15 @@ kind: ClusterRole
 metadata:
   name: proxy-role
 rules:
-- apiGroups: ["authentication.k8s.io"]
+- apiGroups:
+  - authentication.k8s.io
   resources:
   - tokenreviews
-  verbs: ["create"]
-- apiGroups: ["authorization.k8s.io"]
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
   resources:
   - subjectaccessreviews
-  verbs: ["create"]
+  verbs:
+  - create
diff --git a/testdata/project-v3/config/rbac/leader_election_role.yaml b/testdata/project-v3/config/rbac/leader_election_role.yaml
@@ -6,9 +6,19 @@ metadata:
 rules:
 - apiGroups:
   - ""
-  - coordination.k8s.io
   resources:
   - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
   - leases
   verbs:
   - get