github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-30 06:54:01 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #39544 from foxish/fix-rbac-disruption

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 39544, 39552, 39553)

Allow disruption controller to read statefulsets

**What this PR does / why we need it**: Disruption controller was unable to list/watch statefulsets when RBAC is enabled because it wasn't granted permission.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubernetes/issues/39541

cc @mwielgus
This commit is contained in:
Kubernetes Submit Queue 2017-01-06 17:03:07 -08:00 committed by GitHub
commit 8a4f367cf3
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
View File

@ -108,6 +108,7 @@ func init() {
rbac.NewRule("get", "list", "watch").Groups(extensionsGroup).Resources("replicasets").RuleOrDie(), rbac.NewRule("get", "list", "watch").Groups(extensionsGroup).Resources("replicasets").RuleOrDie(),
rbac.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("replicationcontrollers").RuleOrDie(), rbac.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("replicationcontrollers").RuleOrDie(),
rbac.NewRule("get", "list", "watch").Groups(policyGroup).Resources("poddisruptionbudgets").RuleOrDie(), rbac.NewRule("get", "list", "watch").Groups(policyGroup).Resources("poddisruptionbudgets").RuleOrDie(),
rbac.NewRule("get", "list", "watch").Groups(appsGroup).Resources("statefulsets").RuleOrDie(),
rbac.NewRule("update").Groups(policyGroup).Resources("poddisruptionbudgets/status").RuleOrDie(), rbac.NewRule("update").Groups(policyGroup).Resources("poddisruptionbudgets/status").RuleOrDie(),
eventsRule(), eventsRule(),
}, },

9
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml vendored
View File

@ -263,6 +263,15 @@ items:
- get - get
- list - list
- watch - watch
- apiGroups:
- apps
attributeRestrictions: null
resources:
- statefulsets
verbs:
- get
- list
- watch
- apiGroups: - apiGroups:
- policy - policy
attributeRestrictions: null attributeRestrictions: null