github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 12:43:23 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #113267 from hoskeri/cleanup-kubelet-admin-role

Browse Source 
Remove unused RBAC rule from system:kubelet-api-admin
This commit is contained in:
Kubernetes Prow Robot 2022-12-09 14:33:33 -08:00 committed by GitHub
commit da8a78ebd2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cluster/addons/rbac/kubelet-api-auth/kubelet-api-admin-role.yaml
View File

@ -13,6 +13,5 @@ rules:
- nodes/log - nodes/log
- nodes/stats - nodes/stats
- nodes/metrics - nodes/metrics
- nodes/spec
verbs: verbs:
- "*" - "*"

2
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
View File

@ -391,7 +391,7 @@ func ClusterRoles() []rbacv1.ClusterRole {
rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("nodes").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
// Allow all API calls to the nodes // Allow all API calls to the nodes
rbacv1helpers.NewRule("proxy").Groups(legacyGroup).Resources("nodes").RuleOrDie(), rbacv1helpers.NewRule("proxy").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
rbacv1helpers.NewRule("*").Groups(legacyGroup).Resources("nodes/proxy", "nodes/metrics", "nodes/spec", "nodes/stats", "nodes/log").RuleOrDie(), rbacv1helpers.NewRule("*").Groups(legacyGroup).Resources("nodes/proxy", "nodes/metrics", "nodes/stats", "nodes/log").RuleOrDie(),
}, },
}, },
{ {

1
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml vendored
View File

@ -914,7 +914,6 @@ items:
- nodes/log - nodes/log
- nodes/metrics - nodes/metrics
- nodes/proxy - nodes/proxy
- nodes/spec
- nodes/stats - nodes/stats
verbs: verbs:
- '*' - '*'