Skip to content

Commit 262f0e8

Browse files
marvin-tigeramarvin-tigera
authored
Merge pull request #3630 from vara2504/operator_rbac
Restrict tigera-operator secret access to namespace only
2 parents b284f58 + ad4b1b3 commit 262f0e8

33 files changed

+722
-834
lines changed

‎pkg/controller/compliance/compliance_controller.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,7 @@ func (r *ReconcileCompliance) Reconcile(ctx context.Context, request reconcile.R
445445
reqLogger.V(3).Info("rendering components")
446446

447447
namespaceComp := render.NewPassthrough(render.CreateNamespace(helper.InstallNamespace(), network.KubernetesProvider, render.PSSPrivileged, network.Azure))
448+
opSecretsRB := render.NewPassthrough(render.CreateOperatorSecretsRoleBinding(helper.InstallNamespace()))
448449

449450
hasNoLicense := !utils.IsFeatureActive(license, common.ComplianceFeature)
450451
openshift := r.provider.IsOpenShift()
@@ -495,7 +496,7 @@ func (r *ReconcileCompliance) Reconcile(ctx context.Context, request reconcile.R
495496
TrustedBundle: bundleMaker,
496497
})
497498

498-
for _, comp := range []render.Component{namespaceComp, certificateComponent, comp} {
499+
for _, comp := range []render.Component{namespaceComp, opSecretsRB, certificateComponent, comp} {
499500
if err := handler.CreateOrUpdateOrDelete(ctx, comp, r.status); err != nil {
500501
r.status.SetDegraded(operatorv1.ResourceUpdateError, "Error creating / updating / deleting resource", err, reqLogger)
501502
return reconcile.Result{}, err

‎pkg/controller/logstorage/initializer/initializing_controller.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -246,13 +246,25 @@ func (r *LogStorageInitializer) Reconcile(ctx context.Context, request reconcile
246246
return reconcile.Result{}, err
247247
}
248248

249+
esRoleBinding := render.CreateOperatorSecretsRoleBinding(render.ElasticsearchNamespace)
250+
if err = hdler.CreateOrUpdateOrDelete(ctx, render.NewPassthrough(esRoleBinding), r.status); err != nil {
251+
r.status.SetDegraded(operatorv1.ResourceUpdateError, "Error creating / updating resource", err, reqLogger)
252+
return reconcile.Result{}, err
253+
}
254+
249255
// Multitenant clusters do not get kibana, so namespace creation can be skipped.
250256
if !r.multiTenant {
251257
kbNamespace := render.CreateNamespace(kibana.Namespace, install.KubernetesProvider, render.PSSBaseline, install.Azure)
252258
if err = hdler.CreateOrUpdateOrDelete(ctx, render.NewPassthrough(kbNamespace), r.status); err != nil {
253259
r.status.SetDegraded(operatorv1.ResourceUpdateError, "Error creating / updating resource", err, reqLogger)
254260
return reconcile.Result{}, err
255261
}
262+
263+
kbRoleBinding := render.CreateOperatorSecretsRoleBinding(kibana.Namespace)
264+
if err = hdler.CreateOrUpdateOrDelete(ctx, render.NewPassthrough(kbRoleBinding), r.status); err != nil {
265+
r.status.SetDegraded(operatorv1.ResourceUpdateError, "Error creating / updating resource", err, reqLogger)
266+
return reconcile.Result{}, err
267+
}
256268
}
257269

258270
// Write the logstorage back to the datastore with its newly applied defaults.

‎pkg/render/apiserver.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,7 @@ func (c *apiServerComponent) Objects() ([]client.Object, []client.Object) {
247247
// Global enterprise-only objects.
248248
globalEnterpriseObjects := []client.Object{
249249
CreateNamespace(rmeta.APIServerNamespace(operatorv1.TigeraSecureEnterprise), c.cfg.Installation.KubernetesProvider, PSSPrivileged, c.cfg.Installation.Azure),
250+
CreateOperatorSecretsRoleBinding(rmeta.APIServerNamespace(operatorv1.TigeraSecureEnterprise)),
250251
c.tigeraApiServerClusterRole(),
251252
c.tigeraApiServerClusterRoleBinding(),
252253
c.uisettingsgroupGetterClusterRole(),
@@ -305,6 +306,7 @@ func (c *apiServerComponent) Objects() ([]client.Object, []client.Object) {
305306
// Global OSS-only objects.
306307
globalCalicoObjects := []client.Object{
307308
CreateNamespace(rmeta.APIServerNamespace(operatorv1.Calico), c.cfg.Installation.KubernetesProvider, podSecurityNamespaceLabel, c.cfg.Installation.Azure),
309+
CreateOperatorSecretsRoleBinding(rmeta.APIServerNamespace(operatorv1.Calico)),
308310
}
309311

310312
// Compile the final arrays based on the variant.

‎pkg/render/apiserver_test.go‎

Lines changed: 264 additions & 310 deletions
Large diffs are not rendered by default.

‎pkg/render/dex.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ func (c *dexComponent) Objects() ([]client.Object, []client.Object) {
124124
CreateNamespace(DexObjectName, c.cfg.Installation.KubernetesProvider, PSSRestricted, c.cfg.Installation.Azure),
125125
c.allowTigeraNetworkPolicy(c.cfg.Installation.Variant),
126126
networkpolicy.AllowTigeraDefaultDeny(DexNamespace),
127+
CreateOperatorSecretsRoleBinding(DexNamespace),
127128
c.serviceAccount(),
128129
c.deployment(),
129130
c.service(),

‎pkg/render/dex_test.go‎

Lines changed: 35 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -206,33 +206,25 @@ var _ = Describe("dex rendering tests", func() {
206206
component := render.Dex(cfg)
207207
resources, _ := component.Objects()
208208

209-
expectedResources := []struct {
210-
name string
211-
ns string
212-
group string
213-
version string
214-
kind string
215-
}{
216-
{render.DexObjectName, "", "", "v1", "Namespace"},
217-
{render.DexPolicyName, render.DexNamespace, "projectcalico.org", "v3", "NetworkPolicy"},
218-
{networkpolicy.TigeraComponentDefaultDenyPolicyName, render.DexNamespace, "projectcalico.org", "v3", "NetworkPolicy"},
219-
{render.DexObjectName, render.DexNamespace, "", "v1", "ServiceAccount"},
220-
{render.DexObjectName, render.DexNamespace, "apps", "v1", "Deployment"},
221-
{render.DexObjectName, render.DexNamespace, "", "v1", "Service"},
222-
{render.DexObjectName, "", rbac, "v1", "ClusterRole"},
223-
{render.DexObjectName, "", rbac, "v1", "ClusterRoleBinding"},
224-
{render.DexObjectName, render.DexNamespace, "", "v1", "ConfigMap"},
225-
{render.DexObjectName, common.OperatorNamespace(), "", "v1", "Secret"},
226-
{render.OIDCSecretName, common.OperatorNamespace(), "", "v1", "Secret"},
227-
{render.DexObjectName, render.DexNamespace, "", "v1", "Secret"},
228-
{render.OIDCSecretName, render.DexNamespace, "", "v1", "Secret"},
229-
{pullSecretName, render.DexNamespace, "", "v1", "Secret"},
209+
expectedResources := []client.Object{
210+
&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName}, TypeMeta: metav1.TypeMeta{Kind: "Namespace", APIVersion: "v1"}},
211+
&v3.NetworkPolicy{ObjectMeta: metav1.ObjectMeta{Name: render.DexPolicyName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "NetworkPolicy", APIVersion: "projectcalico.org/v3"}},
212+
&v3.NetworkPolicy{ObjectMeta: metav1.ObjectMeta{Name: networkpolicy.TigeraComponentDefaultDenyPolicyName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "NetworkPolicy", APIVersion: "projectcalico.org/v3"}},
213+
&corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "ServiceAccount", APIVersion: "v1"}},
214+
&appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Deployment", APIVersion: "apps/v1"}},
215+
&corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"}},
216+
&rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName}, TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"}},
217+
&rbacv1.ClusterRoleBinding{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName}, TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"}},
218+
&corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "ConfigMap", APIVersion: "v1"}},
219+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: common.OperatorNamespace()}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
220+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: render.OIDCSecretName, Namespace: common.OperatorNamespace()}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
221+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
222+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: render.OIDCSecretName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
223+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: pullSecretName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
224+
&rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: render.TigeraOperatorSecrets, Namespace: render.DexNamespace}},
230225
}
231226

232-
for i, expectedRes := range expectedResources {
233-
rtest.ExpectResourceTypeAndObjectMetadata(resources[i], expectedRes.name, expectedRes.ns, expectedRes.group, expectedRes.version, expectedRes.kind)
234-
}
235-
Expect(len(resources)).To(Equal(len(expectedResources)))
227+
rtest.ExpectResources(resources, expectedResources)
236228

237229
d := rtest.GetResource(resources, "tigera-dex", "tigera-dex", "apps", "v1", "Deployment").(*appsv1.Deployment)
238230

@@ -346,34 +338,26 @@ var _ = Describe("dex rendering tests", func() {
346338
component := render.Dex(cfg)
347339
resources, _ := component.Objects()
348340

349-
expectedResources := []struct {
350-
name string
351-
ns string
352-
group string
353-
version string
354-
kind string
355-
}{
356-
{render.DexObjectName, "", "", "v1", "Namespace"},
357-
{render.DexPolicyName, render.DexNamespace, "projectcalico.org", "v3", "NetworkPolicy"},
358-
{networkpolicy.TigeraComponentDefaultDenyPolicyName, render.DexNamespace, "projectcalico.org", "v3", "NetworkPolicy"},
359-
{render.DexObjectName, render.DexNamespace, "", "v1", "ServiceAccount"},
360-
{render.DexObjectName, render.DexNamespace, "apps", "v1", "Deployment"},
361-
{render.DexObjectName, render.DexNamespace, "", "v1", "Service"},
362-
{render.DexObjectName, "", rbac, "v1", "ClusterRole"},
363-
{render.DexObjectName, "", rbac, "v1", "ClusterRoleBinding"},
364-
{render.DexObjectName, render.DexNamespace, "", "v1", "ConfigMap"},
365-
{render.DexObjectName, common.OperatorNamespace(), "", "v1", "Secret"},
366-
{render.OIDCSecretName, common.OperatorNamespace(), "", "v1", "Secret"},
367-
{render.DexObjectName, render.DexNamespace, "", "v1", "Secret"},
368-
{render.OIDCSecretName, render.DexNamespace, "", "v1", "Secret"},
369-
{pullSecretName, render.DexNamespace, "", "v1", "Secret"},
370-
{"tigera-dex:csr-creator", "", "rbac.authorization.k8s.io", "v1", "ClusterRoleBinding"},
341+
expectedResources := []client.Object{
342+
&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName}, TypeMeta: metav1.TypeMeta{Kind: "Namespace", APIVersion: "v1"}},
343+
&v3.NetworkPolicy{ObjectMeta: metav1.ObjectMeta{Name: render.DexPolicyName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "NetworkPolicy", APIVersion: "projectcalico.org/v3"}},
344+
&v3.NetworkPolicy{ObjectMeta: metav1.ObjectMeta{Name: networkpolicy.TigeraComponentDefaultDenyPolicyName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "NetworkPolicy", APIVersion: "projectcalico.org/v3"}},
345+
&corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "ServiceAccount", APIVersion: "v1"}},
346+
&appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Deployment", APIVersion: "apps/v1"}},
347+
&corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"}},
348+
&rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName}, TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"}},
349+
&rbacv1.ClusterRoleBinding{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName}, TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"}},
350+
&corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "ConfigMap", APIVersion: "v1"}},
351+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: common.OperatorNamespace()}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
352+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: render.OIDCSecretName, Namespace: common.OperatorNamespace()}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
353+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: render.DexObjectName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
354+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: render.OIDCSecretName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
355+
&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: pullSecretName, Namespace: render.DexNamespace}, TypeMeta: metav1.TypeMeta{Kind: "Secret", APIVersion: "v1"}},
356+
&rbacv1.ClusterRoleBinding{ObjectMeta: metav1.ObjectMeta{Name: "tigera-dex:csr-creator"}, TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"}},
357+
&rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: render.TigeraOperatorSecrets, Namespace: render.DexNamespace}},
371358
}
372359

373-
for i, expectedRes := range expectedResources {
374-
rtest.ExpectResourceTypeAndObjectMetadata(resources[i], expectedRes.name, expectedRes.ns, expectedRes.group, expectedRes.version, expectedRes.kind)
375-
}
376-
Expect(len(resources)).To(Equal(len(expectedResources)))
360+
rtest.ExpectResources(resources, expectedResources)
377361
})
378362

379363
It("should render SecurityContextConstrains properly when provider is OpenShift", func() {

‎pkg/render/fluentd.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,7 @@ func (c *fluentdComponent) Objects() ([]client.Object, []client.Object) {
271271
var objs, toDelete []client.Object
272272
objs = append(objs, CreateNamespace(LogCollectorNamespace, c.cfg.Installation.KubernetesProvider, PSSPrivileged, c.cfg.Installation.Azure))
273273
objs = append(objs, c.allowTigeraPolicy())
274+
objs = append(objs, CreateOperatorSecretsRoleBinding(LogCollectorNamespace))
274275
objs = append(objs, secret.ToRuntimeObjects(secret.CopyToNamespace(LogCollectorNamespace, c.cfg.PullSecrets...)...)...)
275276
objs = append(objs, c.metricsService())
276277

0 commit comments

Comments
 (0)