github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 10:51:29 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #82153 from robscott/endpointslice-rbac

Browse Source 
Adding EndpointSlice RBAC for node-proxier/kube-proxy
This commit is contained in:
Kubernetes Prow Robot 2019-08-30 13:05:14 -07:00 committed by GitHub
commit 0ff92e36f2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
View File

@ -352,17 +352,6 @@ func ClusterRoles() []rbacv1.ClusterRole {
eventsRule(), eventsRule(),
}, },
}, },
{
// a role to use for setting up a proxy
ObjectMeta: metav1.ObjectMeta{Name: "system:node-proxier"},
Rules: []rbacv1.PolicyRule{
// Used to build serviceLister
rbacv1helpers.NewRule("list", "watch").Groups(legacyGroup).Resources("services", "endpoints").RuleOrDie(),
rbacv1helpers.NewRule("get").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
eventsRule(),
},
},
{ {
// a role to use for full access to the kubelet API // a role to use for full access to the kubelet API
ObjectMeta: metav1.ObjectMeta{Name: "system:kubelet-api-admin"}, ObjectMeta: metav1.ObjectMeta{Name: "system:kubelet-api-admin"},
@ -473,6 +462,21 @@ func ClusterRoles() []rbacv1.ClusterRole {
}, },
} }
// node-proxier role is used by kube-proxy.
nodeProxierRules := []rbacv1.PolicyRule{
rbacv1helpers.NewRule("list", "watch").Groups(legacyGroup).Resources("services", "endpoints").RuleOrDie(),
rbacv1helpers.NewRule("get").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
eventsRule(),
}
if utilfeature.DefaultFeatureGate.Enabled(features.EndpointSlice) {
nodeProxierRules = append(nodeProxierRules, rbacv1helpers.NewRule("list", "watch").Groups(discoveryGroup).Resources("endpointslices").RuleOrDie())
}
roles = append(roles, rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{Name: "system:node-proxier"},
Rules: nodeProxierRules,
})
kubeSchedulerRules := []rbacv1.PolicyRule{ kubeSchedulerRules := []rbacv1.PolicyRule{
eventsRule(), eventsRule(),
// This is for leaderlease access // This is for leaderlease access