From b5a62f14cdb69193b7539d53325343a0f705f082 Mon Sep 17 00:00:00 2001 From: Jefftree Date: Sun, 21 Jul 2024 20:05:30 +0000 Subject: [PATCH] CLE rbac for lease and leasecandidate in kube-system --- .../rbac/bootstrappolicy/namespace_policy.go | 11 +++-- .../authorizer/rbac/bootstrappolicy/policy.go | 4 +- .../testdata/cluster-roles.yaml | 15 +++++++ .../testdata/namespace-role-bindings.yaml | 3 ++ .../testdata/namespace-roles.yaml | 40 +++++++++++++++++++ 5 files changed, 69 insertions(+), 4 deletions(-) diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/namespace_policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/namespace_policy.go index 745b498ad7d..9329eba2b75 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/namespace_policy.go +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/namespace_policy.go @@ -19,11 +19,11 @@ package bootstrappolicy import ( "strings" - "k8s.io/klog/v2" - rbacv1 "k8s.io/api/rbac/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apiserver/pkg/authentication/user" + "k8s.io/klog/v2" + rbacv1helpers "k8s.io/kubernetes/pkg/apis/rbac/v1" ) @@ -110,6 +110,8 @@ func init() { Rules: []rbacv1.PolicyRule{ rbacv1helpers.NewRule("watch").Groups(legacyGroup).Resources("configmaps").RuleOrDie(), rbacv1helpers.NewRule("get", "update").Groups(legacyGroup).Resources("configmaps").Names("kube-controller-manager").RuleOrDie(), + rbacv1helpers.NewRule("get", "watch", "list", "create", "update").Groups("coordination.k8s.io").Resources("leases").RuleOrDie(), + rbacv1helpers.NewRule("get", "watch", "list", "create", "update").Groups("coordination.k8s.io").Resources("leasecandidates").RuleOrDie(), }, }) addNamespaceRole(metav1.NamespaceSystem, rbacv1.Role{ @@ -118,6 +120,8 @@ func init() { Rules: []rbacv1.PolicyRule{ rbacv1helpers.NewRule("watch").Groups(legacyGroup).Resources("configmaps").RuleOrDie(), rbacv1helpers.NewRule("get", "update").Groups(legacyGroup).Resources("configmaps").Names("kube-scheduler").RuleOrDie(), + rbacv1helpers.NewRule("get", "watch", "list", "create", "update").Groups("coordination.k8s.io").Resources("leases").RuleOrDie(), + rbacv1helpers.NewRule("get", "watch", "list", "create", "update").Groups("coordination.k8s.io").Resources("leasecandidates").RuleOrDie(), }, }) @@ -125,8 +129,9 @@ func init() { delegatedAuthBinding.Name = "system::extension-apiserver-authentication-reader" addNamespaceRoleBinding(metav1.NamespaceSystem, delegatedAuthBinding) + // E1201 20:39:34.550004 1182102 controller.go:231] leases.coordination.k8s.io is forbidden: User "system:serviceaccount:kube-system:leader-election-controller" cannot create resource "leases" in API group "coordination.k8s.io" in the namespace "kube-system" addNamespaceRoleBinding(metav1.NamespaceSystem, - rbacv1helpers.NewRoleBinding("system::leader-locking-kube-controller-manager", metav1.NamespaceSystem).Users(user.KubeControllerManager).SAs(metav1.NamespaceSystem, "kube-controller-manager").BindingOrDie()) + rbacv1helpers.NewRoleBinding("system::leader-locking-kube-controller-manager", metav1.NamespaceSystem).Users(user.KubeControllerManager).SAs(metav1.NamespaceSystem, "kube-controller-manager", "leader-election-controller").BindingOrDie()) addNamespaceRoleBinding(metav1.NamespaceSystem, rbacv1helpers.NewRoleBinding("system::leader-locking-kube-scheduler", metav1.NamespaceSystem).Users(user.KubeScheduler).SAs(metav1.NamespaceSystem, "kube-scheduler").BindingOrDie()) addNamespaceRoleBinding(metav1.NamespaceSystem, diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go index 849591bcbbe..4c203379e1f 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go @@ -25,6 +25,7 @@ import ( "k8s.io/apiserver/pkg/authentication/serviceaccount" "k8s.io/apiserver/pkg/authentication/user" utilfeature "k8s.io/apiserver/pkg/util/feature" + rbacv1helpers "k8s.io/kubernetes/pkg/apis/rbac/v1" "k8s.io/kubernetes/pkg/features" ) @@ -551,7 +552,8 @@ func ClusterRoles() []rbacv1.ClusterRole { // This is for leaderlease access // TODO: scope this to the kube-system namespace rbacv1helpers.NewRule("create").Groups(coordinationGroup).Resources("leases").RuleOrDie(), - rbacv1helpers.NewRule("get", "update").Groups(coordinationGroup).Resources("leases").Names("kube-scheduler").RuleOrDie(), + rbacv1helpers.NewRule("get", "update", "list", "watch").Groups(coordinationGroup).Resources("leases").Names("kube-scheduler").RuleOrDie(), + rbacv1helpers.NewRule(ReadWrite...).Groups(coordinationGroup).Resources("leasecandidates").RuleOrDie(), // Fundamental resources rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("nodes").RuleOrDie(), diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml index 205e3b91e9c..5c5963c2479 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml @@ -741,7 +741,22 @@ items: - leases verbs: - get + - list - update + - watch + - apiGroups: + - coordination.k8s.io + resources: + - leasecandidates + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch - apiGroups: - "" resources: diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-role-bindings.yaml b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-role-bindings.yaml index 01216c1cd52..8c956169955 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-role-bindings.yaml +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-role-bindings.yaml @@ -60,6 +60,9 @@ items: - kind: ServiceAccount name: kube-controller-manager namespace: kube-system + - kind: ServiceAccount + name: leader-election-controller + namespace: kube-system - apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-roles.yaml b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-roles.yaml index 5113551cd34..eca3c6f73aa 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-roles.yaml +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-roles.yaml @@ -83,6 +83,26 @@ items: verbs: - get - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - update + - watch + - apiGroups: + - coordination.k8s.io + resources: + - leasecandidates + verbs: + - create + - get + - list + - update + - watch - apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: @@ -109,6 +129,26 @@ items: verbs: - get - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - update + - watch + - apiGroups: + - coordination.k8s.io + resources: + - leasecandidates + verbs: + - create + - get + - list + - update + - watch - apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: