Skip to content

Commit 9b90297

Browse files
remyj38remyj38
committed
feat: Improve user facing roles with dedicated roles
Signed-off-by: Rémy Jacquin <remy@remyj.fr>
1 parent f169d9d commit 9b90297

File tree

6 files changed

+506
-25
lines changed

6 files changed

+506
-25
lines changed

‎traefik/VALUES.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -404,7 +404,11 @@ Kubernetes: `>=1.22.0-0`
404404
| providers.kubernetesIngress.publishedService.enabled | bool | `true` | Enable [publishedService](https://doc.traefik.io/traefik/providers/kubernetes-ingress/#publishedservice) |
405405
| providers.kubernetesIngress.publishedService.pathOverride | string | `""` | Override path of Kubernetes Service used to copy status from. Format: namespace/servicename. Default to Service deployed with this Chart. |
406406
| providers.kubernetesIngress.strictPrefixMatching | bool | `false` | Defines whether to make prefix matching strictly comply with the Kubernetes Ingress specification. |
407-
| rbac | object | `{"aggregateTo":[],"enabled":true,"namespaced":false,"secretResourceNames":[]}` | Whether Role Based Access Control objects like roles and rolebindings should be created |
407+
| rbac.aggregateAdminTo | list | `[]` | Aggregate Traefik admin role to specified user roles |
408+
| rbac.aggregateViewTo | list | `[]` | Aggregate Traefik view role to specified user roles |
409+
| rbac.enabled | bool | `true` | Whether Role Based Access Control objects like roles and rolebindings should be created |
410+
| rbac.namespaced | bool | `false` | |
411+
| rbac.secretResourceNames | list | `[]` | List of Kubernetes secrets that are accessible for Traefik. If empty, then access is granted to every secret. |
408412
| readinessProbe.failureThreshold | int | `1` | The number of consecutive failures allowed before considering the probe as failed. |
409413
| readinessProbe.initialDelaySeconds | int | `2` | The number of seconds to wait before starting the first probe. |
410414
| readinessProbe.periodSeconds | int | `10` | The number of seconds to wait between consecutive probes. |

‎traefik/templates/rbac/clusterrole.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,6 @@ metadata:
77
name: {{ template "traefik.clusterRoleName" . }}
88
labels:
99
{{- include "traefik.labels" . | nindent 4 }}
10-
{{- range .Values.rbac.aggregateTo }}
11-
rbac.authorization.k8s.io/aggregate-to-{{ . }}: "true"
12-
{{- end }}
1310
rules:
1411
{{- if (semverCompare "<v3.1.0-0" $version) }}
1512
- apiGroups:

‎traefik/templates/rbac/user-facing-roles.yaml‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
{{- $version := include "traefik.proxyVersion" $ }}
2+
{{- if and .Values.rbac.enabled .Values.rbac.aggregateAdminTo }}
3+
---
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
{{- if (not .Values.rbac.namespaced) }}
6+
kind: ClusterRole
7+
{{- else }}
8+
kind: Role
9+
{{- end }}
10+
metadata:
11+
name: {{ template "traefik.clusterRoleName" . }}-admin
12+
labels:
13+
{{- include "traefik.labels" . | nindent 4 }}
14+
{{- range .Values.rbac.aggregateAdminTo }}
15+
rbac.authorization.k8s.io/aggregate-to-{{ . }}: "true"
16+
{{- end }}
17+
rules:
18+
- apiGroups:
19+
- traefik.io
20+
resources:
21+
- ingressroutes
22+
- ingressroutetcps
23+
- ingressrouteudps
24+
- middlewares
25+
- middlewaretcps
26+
- serverstransports
27+
- serverstransporttcps
28+
- tlsoptions
29+
- tlsstores
30+
- traefikservices
31+
verbs:
32+
- create
33+
- delete
34+
- deletecollection
35+
- get
36+
- list
37+
- patch
38+
- update
39+
- watch
40+
{{- if (.Values.providers.kubernetesGateway).enabled }}
41+
- apiGroups:
42+
- gateway.networking.k8s.io
43+
resources:
44+
{{- if semverCompare ">=v3.2.0-0" $version }}
45+
- backendtlspolicies
46+
- grpcroutes
47+
{{- end }}
48+
- gatewayclasses
49+
- gateways
50+
- httproutes
51+
- referencegrants
52+
- tcproutes
53+
- tlsroutes
54+
verbs:
55+
- create
56+
- delete
57+
- deletecollection
58+
- get
59+
- list
60+
- patch
61+
- update
62+
- watch
63+
- apiGroups:
64+
- gateway.networking.k8s.io
65+
resources:
66+
{{- if semverCompare ">=v3.2.0-0" $version }}
67+
- backendtlspolicies/status
68+
- grpcroutes/status
69+
{{- end }}
70+
- gatewayclasses/status
71+
- gateways/status
72+
- httproutes/status
73+
- tcproutes/status
74+
- tlsroutes/status
75+
verbs:
76+
- get
77+
- list
78+
- watch
79+
{{- end }}
80+
{{- if .Values.hub.token }}
81+
{{- if .Values.hub.apimanagement.enabled }}
82+
- apiGroups:
83+
- hub.traefik.io
84+
resources:
85+
- accesscontrolpolicies
86+
- apiauths
87+
- apiportals
88+
- apiportalauths
89+
- apiratelimits
90+
- apis
91+
- apiversions
92+
- apibundles
93+
- apiplans
94+
- apicatalogitems
95+
- managedsubscriptions
96+
- managedapplications
97+
verbs:
98+
- create
99+
- delete
100+
- deletecollection
101+
- get
102+
- list
103+
- patch
104+
- update
105+
- watch
106+
{{- end -}}
107+
{{- end }}
108+
{{- end }}
109+
{{- if and .Values.rbac.enabled .Values.rbac.aggregateViewTo }}
110+
---
111+
apiVersion: rbac.authorization.k8s.io/v1
112+
{{- if (not .Values.rbac.namespaced) }}
113+
kind: ClusterRole
114+
{{- else }}
115+
kind: Role
116+
{{- end }}
117+
metadata:
118+
name: {{ template "traefik.clusterRoleName" . }}-view
119+
labels:
120+
{{- include "traefik.labels" . | nindent 4 }}
121+
{{- range .Values.rbac.aggregateViewTo }}
122+
rbac.authorization.k8s.io/aggregate-to-{{ . }}: "true"
123+
{{- end }}
124+
rules:
125+
- apiGroups:
126+
- traefik.io
127+
resources:
128+
- ingressroutes
129+
- ingressroutetcps
130+
- ingressrouteudps
131+
- middlewares
132+
- middlewaretcps
133+
- serverstransports
134+
- serverstransporttcps
135+
- tlsoptions
136+
- tlsstores
137+
- traefikservices
138+
verbs:
139+
- get
140+
- list
141+
- watch
142+
{{- if (.Values.providers.kubernetesGateway).enabled }}
143+
- apiGroups:
144+
- gateway.networking.k8s.io
145+
resources:
146+
{{- if semverCompare ">=v3.2.0-0" $version }}
147+
- backendtlspolicies
148+
- backendtlspolicies/status
149+
- grpcroutes
150+
- grpcroutes/status
151+
{{- end }}
152+
- gatewayclasses
153+
- gatewayclasses/status
154+
- gateways
155+
- gateways/status
156+
- httproutes
157+
- httproutes/status
158+
- referencegrants
159+
- tcproutes
160+
- tcproutes/status
161+
- tlsroutes
162+
- tlsroutes/status
163+
verbs:
164+
- get
165+
- list
166+
- watch
167+
{{- end }}
168+
{{- if and .Values.hub.token .Values.hub.apimanagement.enabled }}
169+
- apiGroups:
170+
- hub.traefik.io
171+
resources:
172+
- accesscontrolpolicies
173+
- apiauths
174+
- apiportals
175+
- apiportalauths
176+
- apiratelimits
177+
- apis
178+
- apiversions
179+
- apibundles
180+
- apiplans
181+
- apicatalogitems
182+
- managedsubscriptions
183+
- managedapplications
184+
verbs:
185+
- get
186+
- list
187+
- watch
188+
{{- end }}
189+
{{- end }}

0 commit comments

Comments
 (0)