Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Aggregate cluster-reader role #20279

Merged
merged 3 commits into from
Jul 29, 2018
Merged

Aggregate cluster-reader role #20279

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d3105b2
Aggregate cluster-reader role
Jul 10, 2018
726079c
Remove duplicate view roles from aggregated cluster-reader
Jul 11, 2018
b3cb4f9
Update bootstrap tests for aggregated cluster-reader
Jul 11, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions pkg/cmd/server/bootstrappolicy/all_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,10 @@ const osClusterRoleAggregationPrefix = "system:openshift:"
// this map must be manually kept up to date as we make changes to aggregation
// we hard code this data with no constants because we cannot change the underlying values
var expectedAggregationMap = map[string]sets.String{
"admin": sets.NewString("system:openshift:aggregate-to-admin", "system:aggregate-to-admin"),
"edit": sets.NewString("system:openshift:aggregate-to-edit", "system:aggregate-to-edit"),
"view": sets.NewString("system:openshift:aggregate-to-view", "system:aggregate-to-view"),
"admin": sets.NewString("system:openshift:aggregate-to-admin", "system:aggregate-to-admin"),
"edit": sets.NewString("system:openshift:aggregate-to-edit", "system:aggregate-to-edit"),
"view": sets.NewString("system:openshift:aggregate-to-view", "system:aggregate-to-view"),
"cluster-reader": sets.NewString("system:openshift:aggregate-to-view", "system:aggregate-to-view", "system:openshift:aggregate-to-cluster-reader"),
}

func TestPolicyAggregation(t *testing.T) {
Expand Down
33 changes: 17 additions & 16 deletions pkg/cmd/server/bootstrappolicy/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,22 +53,23 @@ const (

// Roles
const (
ClusterAdminRoleName = "cluster-admin"
SudoerRoleName = "sudoer"
ScopeImpersonationRoleName = "system:scope-impersonation"
ClusterReaderRoleName = "cluster-reader"
StorageAdminRoleName = "storage-admin"
ClusterDebuggerRoleName = "cluster-debugger"
AdminRoleName = "admin"
EditRoleName = "edit"
ViewRoleName = "view"
AggregatedAdminRoleName = "system:openshift:aggregate-to-admin"
AggregatedEditRoleName = "system:openshift:aggregate-to-edit"
AggregatedViewRoleName = "system:openshift:aggregate-to-view"
SelfProvisionerRoleName = "self-provisioner"
BasicUserRoleName = "basic-user"
StatusCheckerRoleName = "cluster-status"
SelfAccessReviewerRoleName = "self-access-reviewer"
ClusterAdminRoleName = "cluster-admin"
SudoerRoleName = "sudoer"
ScopeImpersonationRoleName = "system:scope-impersonation"
ClusterReaderRoleName = "cluster-reader"
StorageAdminRoleName = "storage-admin"
ClusterDebuggerRoleName = "cluster-debugger"
AdminRoleName = "admin"
EditRoleName = "edit"
ViewRoleName = "view"
AggregatedAdminRoleName = "system:openshift:aggregate-to-admin"
AggregatedEditRoleName = "system:openshift:aggregate-to-edit"
AggregatedViewRoleName = "system:openshift:aggregate-to-view"
AggregatedClusterReaderRoleName = "system:openshift:aggregate-to-cluster-reader"
SelfProvisionerRoleName = "self-provisioner"
BasicUserRoleName = "basic-user"
StatusCheckerRoleName = "cluster-status"
SelfAccessReviewerRoleName = "self-access-reviewer"

RegistryAdminRoleName = "registry-admin"
RegistryViewerRoleName = "registry-viewer"
Expand Down
87 changes: 48 additions & 39 deletions pkg/cmd/server/bootstrappolicy/policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,35 +131,46 @@ func GetOpenshiftBootstrapClusterRoles() []rbacv1.ClusterRole {
ObjectMeta: metav1.ObjectMeta{
Name: ClusterReaderRoleName,
},
AggregationRule: &rbacv1.AggregationRule{
ClusterRoleSelectors: []metav1.LabelSelector{
{
MatchLabels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-cluster-reader": "true"},
},
{
MatchLabels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-view": "true"},
},
},
},
},
{
ObjectMeta: metav1.ObjectMeta{
Name: AggregatedClusterReaderRoleName,
Labels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-cluster-reader": "true"},
},
Rules: []rbacv1.PolicyRule{
rbacv1helpers.NewRule(read...).Groups(kapiGroup).Resources("bindings", "componentstatuses", "configmaps", "endpoints", "events", "limitranges",
"namespaces", "namespaces/status", "nodes", "nodes/status", "persistentvolumeclaims", "persistentvolumeclaims/status", "persistentvolumes",
"persistentvolumes/status", "pods", "pods/binding", "pods/eviction", "pods/log", "pods/status", "podtemplates", "replicationcontrollers", "replicationcontrollers/scale",
"replicationcontrollers/status", "resourcequotas", "resourcequotas/status", "securitycontextconstraints", "serviceaccounts", "services",
"services/status").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(kapiGroup).Resources("componentstatuses", "nodes", "nodes/status", "persistentvolumeclaims/status", "persistentvolumes",
"persistentvolumes/status", "pods/binding", "pods/eviction", "podtemplates", "securitycontextconstraints", "services/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(admissionRegistrationGroup).Resources("mutatingwebhookconfigurations", "validatingwebhookconfigurations").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(appsGroup).Resources("statefulsets", "statefulsets/scale", "statefulsets/status", "deployments", "deployments/scale", "deployments/status", "controllerrevisions", "daemonsets", "daemonsets/status", "replicasets", "replicasets/status", "replicasets/scale").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(appsGroup).Resources("statefulsets/status", "deployments/status", "controllerrevisions", "daemonsets/status",
"replicasets/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(apiExtensionsGroup).Resources("customresourcedefinitions", "customresourcedefinitions/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(apiRegistrationGroup).Resources("apiservices", "apiservices/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers", "horizontalpodautoscalers/status").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(batchGroup).Resources("jobs", "jobs/status", "cronjobs", "cronjobs/status").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(batchGroup).Resources("jobs/status", "cronjobs/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(extensionsGroup).Resources("daemonsets", "daemonsets/status", "deployments", "deployments/scale",
"deployments/status", "horizontalpodautoscalers", "horizontalpodautoscalers/status", "ingresses", "ingresses/status", "jobs", "jobs/status",
"networkpolicies", "podsecuritypolicies", "replicasets", "replicasets/scale", "replicasets/status", "replicationcontrollers",
"replicationcontrollers/scale", "storageclasses", "thirdpartyresources").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(extensionsGroup).Resources("daemonsets/status", "deployments/status", "horizontalpodautoscalers",
"horizontalpodautoscalers/status", "ingresses/status", "jobs", "jobs/status", "podsecuritypolicies", "replicasets/status", "replicationcontrollers",
"storageclasses", "thirdpartyresources").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(eventsGroup).Resources("events").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(networkingGroup).Resources("networkpolicies").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(policyGroup).Resources("podsecuritypolicies", "poddisruptionbudgets", "poddisruptionbudgets/status").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(policyGroup).Resources("podsecuritypolicies", "poddisruptionbudgets/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(rbacGroup).Resources("roles", "rolebindings", "clusterroles", "clusterrolebindings").RuleOrDie(),

Expand All @@ -169,56 +180,53 @@ func GetOpenshiftBootstrapClusterRoles() []rbacv1.ClusterRole {

rbacv1helpers.NewRule(read...).Groups(schedulingGroup).Resources("priorityclasses").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(certificatesGroup).Resources("certificatesigningrequests", "certificatesigningrequests/approval", "certificatesigningrequests/status").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(certificatesGroup).Resources("certificatesigningrequests", "certificatesigningrequests/approval",
"certificatesigningrequests/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(authzGroup, legacyAuthzGroup).Resources("clusterroles", "clusterrolebindings", "roles", "rolebindings", "rolebindingrestrictions").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(authzGroup, legacyAuthzGroup).Resources("clusterroles", "clusterrolebindings", "roles", "rolebindings",
"rolebindingrestrictions").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(buildGroup, legacyBuildGroup).Resources("builds", "builds/details", "buildconfigs", "buildconfigs/webhooks", "builds/log").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(buildGroup, legacyBuildGroup).Resources("builds/details").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(deployGroup, legacyDeployGroup).Resources("deploymentconfigs", "deploymentconfigs/scale", "deploymentconfigs/log",
"deploymentconfigs/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(imageGroup, legacyImageGroup).Resources("images", "imagesignatures", "imagestreams", "imagestreamtags", "imagestreamimages",
"imagestreams/status").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(imageGroup, legacyImageGroup).Resources("images", "imagesignatures").RuleOrDie(),
// pull images
rbacv1helpers.NewRule("get").Groups(imageGroup, legacyImageGroup).Resources("imagestreams/layers").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(oauthGroup, legacyOauthGroup).Resources("oauthclientauthorizations").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(projectGroup, legacyProjectGroup).Resources("projectrequests", "projects").RuleOrDie(),
// "get" comes in from aggregate-to-view role
rbacv1helpers.NewRule("list", "watch").Groups(projectGroup, legacyProjectGroup).Resources("projects").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(quotaGroup, legacyQuotaGroup).Resources("appliedclusterresourcequotas", "clusterresourcequotas", "clusterresourcequotas/status").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(projectGroup, legacyProjectGroup).Resources("projectrequests").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(routeGroup, legacyRouteGroup).Resources("routes", "routes/status").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(quotaGroup, legacyQuotaGroup).Resources("clusterresourcequotas", "clusterresourcequotas/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(networkGroup, legacyNetworkGroup).Resources("clusternetworks", "egressnetworkpolicies", "hostsubnets", "netnamespaces").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(networkGroup, legacyNetworkGroup).Resources("clusternetworks", "egressnetworkpolicies", "hostsubnets",
"netnamespaces").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(securityGroup, legacySecurityGroup).Resources("securitycontextconstraints").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(securityGroup).Resources("rangeallocations").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(templateGroup, legacyTemplateGroup).Resources("templates", "templateconfigs", "processedtemplates", "templateinstances").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(templateGroup, legacyTemplateGroup).Resources("brokertemplateinstances", "templateinstances/status").RuleOrDie(),

rbacv1helpers.NewRule(read...).Groups(userGroup, legacyUserGroup).Resources("groups", "identities", "useridentitymappings", "users").RuleOrDie(),

// permissions to check access. These creates are non-mutating
rbacv1helpers.NewRule("create").Groups(authzGroup, legacyAuthzGroup).Resources("localresourceaccessreviews", "localsubjectaccessreviews", "resourceaccessreviews",
"selfsubjectrulesreviews", "subjectrulesreviews", "subjectaccessreviews").RuleOrDie(),
rbacv1helpers.NewRule("create").Groups(kAuthzGroup).Resources("selfsubjectaccessreviews", "subjectaccessreviews", "selfsubjectrulesreviews", "localsubjectaccessreviews").RuleOrDie(),
rbacv1helpers.NewRule("create").Groups(authzGroup, legacyAuthzGroup).Resources("localresourceaccessreviews", "localsubjectaccessreviews",
"resourceaccessreviews", "selfsubjectrulesreviews", "subjectrulesreviews", "subjectaccessreviews").RuleOrDie(),
rbacv1helpers.NewRule("create").Groups(kAuthzGroup).Resources("selfsubjectaccessreviews", "subjectaccessreviews", "selfsubjectrulesreviews",
"localsubjectaccessreviews").RuleOrDie(),
rbacv1helpers.NewRule("create").Groups(kAuthnGroup).Resources("tokenreviews").RuleOrDie(),
// permissions to check PSP, these creates are non-mutating
rbacv1helpers.NewRule("create").Groups(securityGroup, legacySecurityGroup).Resources("podsecuritypolicysubjectreviews", "podsecuritypolicyselfsubjectreviews", "podsecuritypolicyreviews").RuleOrDie(),
rbacv1helpers.NewRule("create").Groups(securityGroup, legacySecurityGroup).Resources("podsecuritypolicysubjectreviews",
"podsecuritypolicyselfsubjectreviews", "podsecuritypolicyreviews").RuleOrDie(),
// Allow read access to node metrics
rbacv1helpers.NewRule("get").Groups(kapiGroup).Resources("nodes/"+NodeMetricsSubresource, "nodes/"+NodeSpecSubresource).RuleOrDie(),
// Allow read access to stats
// Node stats requests are submitted as POSTs. These creates are non-mutating
rbacv1helpers.NewRule("get", "create").Groups(kapiGroup).Resources("nodes/" + NodeStatsSubresource).RuleOrDie(),

rbacv1helpers.NewRule("get").URLs(rbac.NonResourceAll).RuleOrDie(),

// backwards compatibility
rbacv1helpers.NewRule(read...).Groups(buildGroup, legacyBuildGroup).Resources("buildlogs").RuleOrDie(),
rbacv1helpers.NewRule(read...).Groups(kapiGroup).Resources("resourcequotausages").RuleOrDie(),
},
},
{
Expand Down Expand Up @@ -1010,8 +1018,9 @@ func GetBootstrapNamespaceRoleBindings() map[string][]rbacv1.RoleBinding {

func GetBootstrapClusterRolesToAggregate() map[string]string {
return map[string]string{
AdminRoleName: AggregatedAdminRoleName,
EditRoleName: AggregatedEditRoleName,
ViewRoleName: AggregatedViewRoleName,
AdminRoleName: AggregatedAdminRoleName,
EditRoleName: AggregatedEditRoleName,
ViewRoleName: AggregatedViewRoleName,
ClusterReaderRoleName: AggregatedClusterReaderRoleName,
}
}
1 change: 1 addition & 0 deletions pkg/cmd/server/bootstrappolicy/web_console_role_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@ var rolesToHide = sets.NewString(
"system:openshift:aggregate-to-admin",
"system:openshift:aggregate-to-edit",
"system:openshift:aggregate-to-view",
"system:openshift:aggregate-to-cluster-reader",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@openshift/origin-web-console-committers I've added a new role here that I think should be hidden to the end user, (heads up per the test's comment)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mrogers950 @enj aha, the test lives! But we can eliminate that test, might be a good time to do so?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@benjaminapetersen I can do a follow-up to get rid of this test if it's no longer useful.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mrogers950 sounds good. Happy to chat about it if that would be helpful.

"system:kubelet-api-admin",
"system:volume-scheduler",
)
Expand Down
Loading