github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-28 14:07:14 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #44645 from mikedanese/cm-get-secrets

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 44645, 44639, 43510)

allow the token controller to get secrets

we need this on secret rotation here:

2c1c0f3f72/pkg/controller/serviceaccount/tokens_controller.go (L478-L481)


cc @liggitt
This commit is contained in:
Kubernetes Submit Queue 2017-04-18 23:22:00 -07:00 committed by GitHub
commit 68131471a5
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
View File

@ -300,8 +300,8 @@ func ClusterRoles() []rbac.ClusterRole {
eventsRule(), eventsRule(),
rbac.NewRule("create").Groups(legacyGroup).Resources("endpoints", "secrets", "serviceaccounts").RuleOrDie(), rbac.NewRule("create").Groups(legacyGroup).Resources("endpoints", "secrets", "serviceaccounts").RuleOrDie(),
rbac.NewRule("delete").Groups(legacyGroup).Resources("secrets").RuleOrDie(), rbac.NewRule("delete").Groups(legacyGroup).Resources("secrets").RuleOrDie(),
rbac.NewRule("get").Groups(legacyGroup).Resources("endpoints", "namespaces", "serviceaccounts").RuleOrDie(), rbac.NewRule("get").Groups(legacyGroup).Resources("endpoints", "namespaces", "secrets", "serviceaccounts").RuleOrDie(),
rbac.NewRule("update").Groups(legacyGroup).Resources("endpoints", "serviceaccounts").RuleOrDie(), rbac.NewRule("update").Groups(legacyGroup).Resources("endpoints", "secrets", "serviceaccounts").RuleOrDie(),
// Needed to check API access. These creates are non-mutating // Needed to check API access. These creates are non-mutating
rbac.NewRule("create").Groups(authenticationGroup).Resources("tokenreviews").RuleOrDie(), rbac.NewRule("create").Groups(authenticationGroup).Resources("tokenreviews").RuleOrDie(),

2
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml vendored
View File

@ -460,6 +460,7 @@ items:
resources: resources:
- endpoints - endpoints
- namespaces - namespaces
- secrets
- serviceaccounts - serviceaccounts
verbs: verbs:
- get - get
@ -467,6 +468,7 @@ items:
- "" - ""
resources: resources:
- endpoints - endpoints
- secrets
- serviceaccounts - serviceaccounts
verbs: verbs:
- update - update