github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 02:41:25 +00:00
Code Issues Projects Releases Wiki Activity

Remove unused RBAC rule from system:kubelet-api-admin

Browse Source 
cd54bd94e9 removes the
handlers for /spec from the kubelet server.

Cleanup the RBAC rules as well.

Change-Id: Id6befbcacec27ad383e336b7189289f55c1c0a68
This commit is contained in:
Abhijit Hoskeri 2022-10-21 11:57:07 -07:00
parent a497c56c33
commit 9f2ac979ae
3 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cluster/addons/rbac/kubelet-api-auth/kubelet-api-admin-role.yaml
View File

@ -13,6 +13,5 @@ rules:
- nodes/log - nodes/log
- nodes/stats - nodes/stats
- nodes/metrics - nodes/metrics
- nodes/spec
verbs: verbs:
- "*" - "*"

2
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
View File

@ -384,7 +384,7 @@ func ClusterRoles() []rbacv1.ClusterRole {
rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("nodes").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
// Allow all API calls to the nodes // Allow all API calls to the nodes
rbacv1helpers.NewRule("proxy").Groups(legacyGroup).Resources("nodes").RuleOrDie(), rbacv1helpers.NewRule("proxy").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
rbacv1helpers.NewRule("*").Groups(legacyGroup).Resources("nodes/proxy", "nodes/metrics", "nodes/spec", "nodes/stats", "nodes/log").RuleOrDie(), rbacv1helpers.NewRule("*").Groups(legacyGroup).Resources("nodes/proxy", "nodes/metrics", "nodes/stats", "nodes/log").RuleOrDie(),
}, },
}, },
{ {

1
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml vendored
View File

@ -914,7 +914,6 @@ items:
- nodes/log - nodes/log
- nodes/metrics - nodes/metrics
- nodes/proxy - nodes/proxy
- nodes/spec
- nodes/stats - nodes/stats
verbs: verbs:
- '*' - '*'