mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-08-02 08:17:26 +00:00
add clusterrolebindings to bootstrapping
This commit is contained in:
parent
e72f26a3ff
commit
467b7d928f
@ -20,6 +20,7 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
|
"k8s.io/kubernetes/pkg/api"
|
||||||
"k8s.io/kubernetes/pkg/api/unversioned"
|
"k8s.io/kubernetes/pkg/api/unversioned"
|
||||||
)
|
)
|
||||||
|
|
||||||
@ -162,3 +163,61 @@ func (r *PolicyRuleBuilder) Rule() (PolicyRule, error) {
|
|||||||
|
|
||||||
return r.PolicyRule, nil
|
return r.PolicyRule, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// +k8s:deepcopy-gen=false
|
||||||
|
// ClusterRoleBindingBuilder let's us attach methods. A no-no for API types.
|
||||||
|
// We use it to construct bindings in code. It's more compact than trying to write them
|
||||||
|
// out in a literal.
|
||||||
|
type ClusterRoleBindingBuilder struct {
|
||||||
|
ClusterRoleBinding ClusterRoleBinding
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewClusterBinding(clusterRoleName string) *ClusterRoleBindingBuilder {
|
||||||
|
return &ClusterRoleBindingBuilder{
|
||||||
|
ClusterRoleBinding: ClusterRoleBinding{
|
||||||
|
ObjectMeta: api.ObjectMeta{Name: clusterRoleName},
|
||||||
|
RoleRef: RoleRef{
|
||||||
|
APIGroup: GroupName,
|
||||||
|
Kind: "ClusterRole",
|
||||||
|
Name: clusterRoleName,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *ClusterRoleBindingBuilder) Groups(groups ...string) *ClusterRoleBindingBuilder {
|
||||||
|
for _, group := range groups {
|
||||||
|
r.ClusterRoleBinding.Subjects = append(r.ClusterRoleBinding.Subjects, Subject{Kind: GroupKind, Name: group})
|
||||||
|
}
|
||||||
|
return r
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *ClusterRoleBindingBuilder) Users(users ...string) *ClusterRoleBindingBuilder {
|
||||||
|
for _, user := range users {
|
||||||
|
r.ClusterRoleBinding.Subjects = append(r.ClusterRoleBinding.Subjects, Subject{Kind: UserKind, Name: user})
|
||||||
|
}
|
||||||
|
return r
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *ClusterRoleBindingBuilder) SAs(namespace string, serviceAccountNames ...string) *ClusterRoleBindingBuilder {
|
||||||
|
for _, saName := range serviceAccountNames {
|
||||||
|
r.ClusterRoleBinding.Subjects = append(r.ClusterRoleBinding.Subjects, Subject{Kind: ServiceAccountKind, Namespace: namespace, Name: saName})
|
||||||
|
}
|
||||||
|
return r
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *ClusterRoleBindingBuilder) BindingOrDie() ClusterRoleBinding {
|
||||||
|
ret, err := r.Binding()
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
return ret
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *ClusterRoleBindingBuilder) Binding() (ClusterRoleBinding, error) {
|
||||||
|
if len(r.ClusterRoleBinding.Subjects) == 0 {
|
||||||
|
return ClusterRoleBinding{}, fmt.Errorf("subjects are required: %#v", r.ClusterRoleBinding)
|
||||||
|
}
|
||||||
|
|
||||||
|
return r.ClusterRoleBinding, nil
|
||||||
|
}
|
||||||
|
@ -5004,6 +5004,23 @@ var OpenAPIDefinitions *common.OpenAPIDefinitions = &common.OpenAPIDefinitions{
|
|||||||
Dependencies: []string{
|
Dependencies: []string{
|
||||||
"api.ObjectMeta", "rbac.RoleRef", "rbac.Subject", "unversioned.TypeMeta"},
|
"api.ObjectMeta", "rbac.RoleRef", "rbac.Subject", "unversioned.TypeMeta"},
|
||||||
},
|
},
|
||||||
|
"rbac.ClusterRoleBindingBuilder": {
|
||||||
|
Schema: spec.Schema{
|
||||||
|
SchemaProps: spec.SchemaProps{
|
||||||
|
Description: "ClusterRoleBindingBuilder let's us attach methods. A no-no for API types. We use it to construct bindings in code. It's more compact than trying to write them out in a literal.",
|
||||||
|
Properties: map[string]spec.Schema{
|
||||||
|
"ClusterRoleBinding": {
|
||||||
|
SchemaProps: spec.SchemaProps{
|
||||||
|
Ref: spec.MustCreateRef("#/definitions/rbac.ClusterRoleBinding"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Required: []string{"ClusterRoleBinding"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Dependencies: []string{
|
||||||
|
"rbac.ClusterRoleBinding"},
|
||||||
|
},
|
||||||
"rbac.ClusterRoleBindingList": {
|
"rbac.ClusterRoleBindingList": {
|
||||||
Schema: spec.Schema{
|
Schema: spec.Schema{
|
||||||
SchemaProps: spec.SchemaProps{
|
SchemaProps: spec.SchemaProps{
|
||||||
|
@ -131,5 +131,25 @@ func PostStartHook(hookContext genericapiserver.PostStartHookContext) error {
|
|||||||
glog.Infof("Created clusterrole.%s/%s", rbac.GroupName, clusterRole.Name)
|
glog.Infof("Created clusterrole.%s/%s", rbac.GroupName, clusterRole.Name)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
existingClusterRoleBindings, err := clientset.ClusterRoleBindings().List(api.ListOptions{})
|
||||||
|
if err != nil {
|
||||||
|
utilruntime.HandleError(fmt.Errorf("unable to initialize clusterrolebindings: %v", err))
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
// if clusterrolebindings already exist, then assume we don't have work to do because we've already
|
||||||
|
// initialized or another API server has started this task
|
||||||
|
if len(existingClusterRoleBindings.Items) > 0 {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, clusterRoleBinding := range append(bootstrappolicy.ClusterRoleBindings(), bootstrappolicy.ControllerRoleBindings()...) {
|
||||||
|
if _, err := clientset.ClusterRoleBindings().Create(&clusterRoleBinding); err != nil {
|
||||||
|
// don't fail on failures, try to create as many as you can
|
||||||
|
utilruntime.HandleError(fmt.Errorf("unable to initialize clusterrolebindings: %v", err))
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
glog.Infof("Created clusterrolebinding.%s/%s", rbac.GroupName, clusterRoleBinding.Name)
|
||||||
|
}
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
@ -25,14 +25,18 @@ import (
|
|||||||
rbac "k8s.io/kubernetes/pkg/apis/rbac"
|
rbac "k8s.io/kubernetes/pkg/apis/rbac"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
const saRolePrefix = "system:controller:"
|
||||||
|
|
||||||
var (
|
var (
|
||||||
// controllerRoles is a slice of roles used for controllers
|
// controllerRoles is a slice of roles used for controllers
|
||||||
controllerRoles = []rbac.ClusterRole{}
|
controllerRoles = []rbac.ClusterRole{}
|
||||||
|
// controllerRoleBindings is a slice of roles used for controllers
|
||||||
|
controllerRoleBindings = []rbac.ClusterRoleBinding{}
|
||||||
)
|
)
|
||||||
|
|
||||||
func addControllerRole(role rbac.ClusterRole) {
|
func addControllerRole(role rbac.ClusterRole) {
|
||||||
if !strings.HasPrefix(role.Name, "system:controller:") {
|
if !strings.HasPrefix(role.Name, saRolePrefix) {
|
||||||
glog.Fatalf(`role %q must start with "system:controller:"`, role.Name)
|
glog.Fatalf(`role %q must start with %q`, role.Name, saRolePrefix)
|
||||||
}
|
}
|
||||||
|
|
||||||
for _, existingRole := range controllerRoles {
|
for _, existingRole := range controllerRoles {
|
||||||
@ -42,6 +46,8 @@ func addControllerRole(role rbac.ClusterRole) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
controllerRoles = append(controllerRoles, role)
|
controllerRoles = append(controllerRoles, role)
|
||||||
|
controllerRoleBindings = append(controllerRoleBindings,
|
||||||
|
rbac.NewClusterBinding(role.Name).SAs("kube-system", role.Name[len(saRolePrefix):]).BindingOrDie())
|
||||||
}
|
}
|
||||||
|
|
||||||
func eventsRule() rbac.PolicyRule {
|
func eventsRule() rbac.PolicyRule {
|
||||||
@ -50,7 +56,7 @@ func eventsRule() rbac.PolicyRule {
|
|||||||
|
|
||||||
func init() {
|
func init() {
|
||||||
addControllerRole(rbac.ClusterRole{
|
addControllerRole(rbac.ClusterRole{
|
||||||
ObjectMeta: api.ObjectMeta{Name: "system:controller:replication-controller"},
|
ObjectMeta: api.ObjectMeta{Name: saRolePrefix + "replication-controller"},
|
||||||
Rules: []rbac.PolicyRule{
|
Rules: []rbac.PolicyRule{
|
||||||
rbac.NewRule("get", "list", "watch", "update").Groups(legacyGroup).Resources("replicationcontrollers").RuleOrDie(),
|
rbac.NewRule("get", "list", "watch", "update").Groups(legacyGroup).Resources("replicationcontrollers").RuleOrDie(),
|
||||||
rbac.NewRule("update").Groups(legacyGroup).Resources("replicationcontrollers/status").RuleOrDie(),
|
rbac.NewRule("update").Groups(legacyGroup).Resources("replicationcontrollers/status").RuleOrDie(),
|
||||||
@ -64,3 +70,8 @@ func init() {
|
|||||||
func ControllerRoles() []rbac.ClusterRole {
|
func ControllerRoles() []rbac.ClusterRole {
|
||||||
return controllerRoles
|
return controllerRoles
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// ControllerRoleBindings returns the role bindings used by controllers
|
||||||
|
func ControllerRoleBindings() []rbac.ClusterRoleBinding {
|
||||||
|
return controllerRoleBindings
|
||||||
|
}
|
||||||
|
@ -19,6 +19,7 @@ package bootstrappolicy
|
|||||||
import (
|
import (
|
||||||
"k8s.io/kubernetes/pkg/api"
|
"k8s.io/kubernetes/pkg/api"
|
||||||
rbac "k8s.io/kubernetes/pkg/apis/rbac"
|
rbac "k8s.io/kubernetes/pkg/apis/rbac"
|
||||||
|
"k8s.io/kubernetes/pkg/auth/user"
|
||||||
)
|
)
|
||||||
|
|
||||||
var (
|
var (
|
||||||
@ -48,3 +49,11 @@ func ClusterRoles() []rbac.ClusterRole {
|
|||||||
},
|
},
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// ClusterRoleBindings return default rolebindings to the default roles
|
||||||
|
func ClusterRoleBindings() []rbac.ClusterRoleBinding {
|
||||||
|
return []rbac.ClusterRoleBinding{
|
||||||
|
rbac.NewClusterBinding("cluster-admin").Groups(user.SystemPrivilegedGroup).BindingOrDie(),
|
||||||
|
rbac.NewClusterBinding("system:discovery").Groups(user.AllAuthenticated, user.AllUnauthenticated).BindingOrDie(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user