Skip to content

Commit 718ed7d

Browse files
ritazhritazh
committed
dra: add user rbac
Signed-off-by: Rita Zhang <[email protected]>
1 parent 0446f6c commit 718ed7d

File tree

1 file changed

+72
-62
lines changed
  • plugin/pkg/auth/authorizer/rbac/bootstrappolicy

1 file changed

+72
-62
lines changed

‎plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go‎

Lines changed: 72 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,76 @@ func addClusterRoleBindingLabel(rolebindings []rbacv1.ClusterRoleBinding) {
108108
return
109109
}
110110

111+
func viewRules() []rbacv1.PolicyRule {
112+
rules := []rbacv1.PolicyRule{
113+
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("pods", "replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts",
114+
"services", "services/status", "endpoints", "persistentvolumeclaims", "persistentvolumeclaims/status", "configmaps").RuleOrDie(),
115+
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("limitranges", "resourcequotas", "bindings", "events",
116+
"pods/status", "resourcequotas/status", "namespaces/status", "replicationcontrollers/status", "pods/log").RuleOrDie(),
117+
// read access to namespaces at the namespace scope means you can read *this* namespace. This can be used as an
118+
// indicator of which namespaces you have access to.
119+
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("namespaces").RuleOrDie(),
120+
121+
rbacv1helpers.NewRule(Read...).Groups(discoveryGroup).Resources("endpointslices").RuleOrDie(),
122+
123+
rbacv1helpers.NewRule(Read...).Groups(appsGroup).Resources(
124+
"controllerrevisions",
125+
"statefulsets", "statefulsets/status", "statefulsets/scale",
126+
"daemonsets", "daemonsets/status",
127+
"deployments", "deployments/status", "deployments/scale",
128+
"replicasets", "replicasets/status", "replicasets/scale").RuleOrDie(),
129+
130+
rbacv1helpers.NewRule(Read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers", "horizontalpodautoscalers/status").RuleOrDie(),
131+
132+
rbacv1helpers.NewRule(Read...).Groups(batchGroup).Resources("jobs", "cronjobs", "cronjobs/status", "jobs/status").RuleOrDie(),
133+
134+
rbacv1helpers.NewRule(Read...).Groups(extensionsGroup).Resources("daemonsets", "daemonsets/status", "deployments", "deployments/scale", "deployments/status",
135+
"ingresses", "ingresses/status", "replicasets", "replicasets/scale", "replicasets/status", "replicationcontrollers/scale",
136+
"networkpolicies").RuleOrDie(),
137+
138+
rbacv1helpers.NewRule(Read...).Groups(policyGroup).Resources("poddisruptionbudgets", "poddisruptionbudgets/status").RuleOrDie(),
139+
140+
rbacv1helpers.NewRule(Read...).Groups(networkingGroup).Resources("networkpolicies", "ingresses", "ingresses/status").RuleOrDie(),
141+
}
142+
return rules
143+
}
144+
145+
func editRules() []rbacv1.PolicyRule {
146+
rules := []rbacv1.PolicyRule{
147+
// Allow read on escalating resources
148+
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("pods/attach", "pods/proxy", "pods/exec", "pods/portforward", "secrets", "services/proxy").RuleOrDie(),
149+
rbacv1helpers.NewRule("impersonate").Groups(legacyGroup).Resources("serviceaccounts").RuleOrDie(),
150+
151+
rbacv1helpers.NewRule(Write...).Groups(legacyGroup).Resources("pods", "pods/attach", "pods/proxy", "pods/exec", "pods/portforward").RuleOrDie(),
152+
rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("pods/eviction").RuleOrDie(),
153+
rbacv1helpers.NewRule(Write...).Groups(legacyGroup).Resources("replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts",
154+
"services", "services/proxy", "persistentvolumeclaims", "configmaps", "secrets", "events").RuleOrDie(),
155+
rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("serviceaccounts/token").RuleOrDie(),
156+
157+
rbacv1helpers.NewRule(Write...).Groups(appsGroup).Resources(
158+
"statefulsets", "statefulsets/scale",
159+
"daemonsets",
160+
"deployments", "deployments/scale", "deployments/rollback",
161+
"replicasets", "replicasets/scale").RuleOrDie(),
162+
163+
rbacv1helpers.NewRule(Write...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers").RuleOrDie(),
164+
165+
rbacv1helpers.NewRule(Write...).Groups(batchGroup).Resources("jobs", "cronjobs").RuleOrDie(),
166+
167+
rbacv1helpers.NewRule(Write...).Groups(extensionsGroup).Resources("daemonsets",
168+
"deployments", "deployments/scale", "deployments/rollback", "ingresses",
169+
"replicasets", "replicasets/scale", "replicationcontrollers/scale",
170+
"networkpolicies").RuleOrDie(),
171+
172+
rbacv1helpers.NewRule(Write...).Groups(policyGroup).Resources("poddisruptionbudgets").RuleOrDie(),
173+
174+
rbacv1helpers.NewRule(Write...).Groups(networkingGroup).Resources("networkpolicies", "ingresses").RuleOrDie(),
175+
176+
rbacv1helpers.NewRule(ReadWrite...).Groups(coordinationGroup).Resources("leases").RuleOrDie(),
177+
}
178+
return rules
179+
}
180+
111181
// NodeRules returns node policy rules, it is slice of rbacv1.PolicyRule.
112182
func NodeRules() []rbacv1.PolicyRule {
113183
nodePolicyRules := []rbacv1.PolicyRule{
@@ -313,73 +383,13 @@ func ClusterRoles() []rbacv1.ClusterRole {
313383
// It does not grant powers for "privileged" resources which are domain of the system: `/status`
314384
// subresources or `quota`/`limits` which are used to control namespaces
315385
ObjectMeta: metav1.ObjectMeta{Name: "system:aggregate-to-edit", Labels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-edit": "true"}},
316-
Rules: []rbacv1.PolicyRule{
317-
// Allow read on escalating resources
318-
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("pods/attach", "pods/proxy", "pods/exec", "pods/portforward", "secrets", "services/proxy").RuleOrDie(),
319-
rbacv1helpers.NewRule("impersonate").Groups(legacyGroup).Resources("serviceaccounts").RuleOrDie(),
320-
321-
rbacv1helpers.NewRule(Write...).Groups(legacyGroup).Resources("pods", "pods/attach", "pods/proxy", "pods/exec", "pods/portforward").RuleOrDie(),
322-
rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("pods/eviction").RuleOrDie(),
323-
rbacv1helpers.NewRule(Write...).Groups(legacyGroup).Resources("replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts",
324-
"services", "services/proxy", "persistentvolumeclaims", "configmaps", "secrets", "events").RuleOrDie(),
325-
rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("serviceaccounts/token").RuleOrDie(),
326-
327-
rbacv1helpers.NewRule(Write...).Groups(appsGroup).Resources(
328-
"statefulsets", "statefulsets/scale",
329-
"daemonsets",
330-
"deployments", "deployments/scale", "deployments/rollback",
331-
"replicasets", "replicasets/scale").RuleOrDie(),
332-
333-
rbacv1helpers.NewRule(Write...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers").RuleOrDie(),
334-
335-
rbacv1helpers.NewRule(Write...).Groups(batchGroup).Resources("jobs", "cronjobs").RuleOrDie(),
336-
337-
rbacv1helpers.NewRule(Write...).Groups(extensionsGroup).Resources("daemonsets",
338-
"deployments", "deployments/scale", "deployments/rollback", "ingresses",
339-
"replicasets", "replicasets/scale", "replicationcontrollers/scale",
340-
"networkpolicies").RuleOrDie(),
341-
342-
rbacv1helpers.NewRule(Write...).Groups(policyGroup).Resources("poddisruptionbudgets").RuleOrDie(),
343-
344-
rbacv1helpers.NewRule(Write...).Groups(networkingGroup).Resources("networkpolicies", "ingresses").RuleOrDie(),
345-
346-
rbacv1helpers.NewRule(ReadWrite...).Groups(coordinationGroup).Resources("leases").RuleOrDie(),
347-
},
386+
Rules: editRules(),
348387
},
349388
{
350389
// a role for namespace level viewing. It grants Read-only access to non-escalating resources in
351390
// a namespace.
352391
ObjectMeta: metav1.ObjectMeta{Name: "system:aggregate-to-view", Labels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-view": "true"}},
353-
Rules: []rbacv1.PolicyRule{
354-
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("pods", "replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts",
355-
"services", "services/status", "endpoints", "persistentvolumeclaims", "persistentvolumeclaims/status", "configmaps").RuleOrDie(),
356-
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("limitranges", "resourcequotas", "bindings", "events",
357-
"pods/status", "resourcequotas/status", "namespaces/status", "replicationcontrollers/status", "pods/log").RuleOrDie(),
358-
// read access to namespaces at the namespace scope means you can read *this* namespace. This can be used as an
359-
// indicator of which namespaces you have access to.
360-
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("namespaces").RuleOrDie(),
361-
362-
rbacv1helpers.NewRule(Read...).Groups(discoveryGroup).Resources("endpointslices").RuleOrDie(),
363-
364-
rbacv1helpers.NewRule(Read...).Groups(appsGroup).Resources(
365-
"controllerrevisions",
366-
"statefulsets", "statefulsets/status", "statefulsets/scale",
367-
"daemonsets", "daemonsets/status",
368-
"deployments", "deployments/status", "deployments/scale",
369-
"replicasets", "replicasets/status", "replicasets/scale").RuleOrDie(),
370-
371-
rbacv1helpers.NewRule(Read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers", "horizontalpodautoscalers/status").RuleOrDie(),
372-
373-
rbacv1helpers.NewRule(Read...).Groups(batchGroup).Resources("jobs", "cronjobs", "cronjobs/status", "jobs/status").RuleOrDie(),
374-
375-
rbacv1helpers.NewRule(Read...).Groups(extensionsGroup).Resources("daemonsets", "daemonsets/status", "deployments", "deployments/scale", "deployments/status",
376-
"ingresses", "ingresses/status", "replicasets", "replicasets/scale", "replicasets/status", "replicationcontrollers/scale",
377-
"networkpolicies").RuleOrDie(),
378-
379-
rbacv1helpers.NewRule(Read...).Groups(policyGroup).Resources("poddisruptionbudgets", "poddisruptionbudgets/status").RuleOrDie(),
380-
381-
rbacv1helpers.NewRule(Read...).Groups(networkingGroup).Resources("networkpolicies", "ingresses", "ingresses/status").RuleOrDie(),
382-
},
392+
Rules: viewRules(),
383393
},
384394
{
385395
// a role to use for heapster's connections back to the API server

0 commit comments

Comments
 (0)