Skip to content

Commit b29c2f5

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#130738 from ritazh/dra-user-rbac
DRA: add user rbac
2 parents c12006e + 06482b6 commit b29c2f5

File tree

3 files changed

+1585
-62
lines changed

3 files changed

+1585
-62
lines changed

‎plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go‎

Lines changed: 79 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,83 @@ func addClusterRoleBindingLabel(rolebindings []rbacv1.ClusterRoleBinding) {
108108
return
109109
}
110110

111+
func viewRules() []rbacv1.PolicyRule {
112+
rules := []rbacv1.PolicyRule{
113+
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("pods", "replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts",
114+
"services", "services/status", "endpoints", "persistentvolumeclaims", "persistentvolumeclaims/status", "configmaps").RuleOrDie(),
115+
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("limitranges", "resourcequotas", "bindings", "events",
116+
"pods/status", "resourcequotas/status", "namespaces/status", "replicationcontrollers/status", "pods/log").RuleOrDie(),
117+
// read access to namespaces at the namespace scope means you can read *this* namespace. This can be used as an
118+
// indicator of which namespaces you have access to.
119+
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("namespaces").RuleOrDie(),
120+
121+
rbacv1helpers.NewRule(Read...).Groups(discoveryGroup).Resources("endpointslices").RuleOrDie(),
122+
123+
rbacv1helpers.NewRule(Read...).Groups(appsGroup).Resources(
124+
"controllerrevisions",
125+
"statefulsets", "statefulsets/status", "statefulsets/scale",
126+
"daemonsets", "daemonsets/status",
127+
"deployments", "deployments/status", "deployments/scale",
128+
"replicasets", "replicasets/status", "replicasets/scale").RuleOrDie(),
129+
130+
rbacv1helpers.NewRule(Read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers", "horizontalpodautoscalers/status").RuleOrDie(),
131+
132+
rbacv1helpers.NewRule(Read...).Groups(batchGroup).Resources("jobs", "cronjobs", "cronjobs/status", "jobs/status").RuleOrDie(),
133+
134+
rbacv1helpers.NewRule(Read...).Groups(extensionsGroup).Resources("daemonsets", "daemonsets/status", "deployments", "deployments/scale", "deployments/status",
135+
"ingresses", "ingresses/status", "replicasets", "replicasets/scale", "replicasets/status", "replicationcontrollers/scale",
136+
"networkpolicies").RuleOrDie(),
137+
138+
rbacv1helpers.NewRule(Read...).Groups(policyGroup).Resources("poddisruptionbudgets", "poddisruptionbudgets/status").RuleOrDie(),
139+
140+
rbacv1helpers.NewRule(Read...).Groups(networkingGroup).Resources("networkpolicies", "ingresses", "ingresses/status").RuleOrDie(),
141+
}
142+
143+
if utilfeature.DefaultFeatureGate.Enabled(features.DynamicResourceAllocation) {
144+
rules = append(rules, rbacv1helpers.NewRule(Read...).Groups(resourceGroup).Resources("resourceclaims", "resourceclaims/status", "resourceclaimtemplates").RuleOrDie())
145+
}
146+
return rules
147+
}
148+
149+
func editRules() []rbacv1.PolicyRule {
150+
rules := []rbacv1.PolicyRule{
151+
// Allow read on escalating resources
152+
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("pods/attach", "pods/proxy", "pods/exec", "pods/portforward", "secrets", "services/proxy").RuleOrDie(),
153+
rbacv1helpers.NewRule("impersonate").Groups(legacyGroup).Resources("serviceaccounts").RuleOrDie(),
154+
155+
rbacv1helpers.NewRule(Write...).Groups(legacyGroup).Resources("pods", "pods/attach", "pods/proxy", "pods/exec", "pods/portforward").RuleOrDie(),
156+
rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("pods/eviction").RuleOrDie(),
157+
rbacv1helpers.NewRule(Write...).Groups(legacyGroup).Resources("replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts",
158+
"services", "services/proxy", "persistentvolumeclaims", "configmaps", "secrets", "events").RuleOrDie(),
159+
rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("serviceaccounts/token").RuleOrDie(),
160+
161+
rbacv1helpers.NewRule(Write...).Groups(appsGroup).Resources(
162+
"statefulsets", "statefulsets/scale",
163+
"daemonsets",
164+
"deployments", "deployments/scale", "deployments/rollback",
165+
"replicasets", "replicasets/scale").RuleOrDie(),
166+
167+
rbacv1helpers.NewRule(Write...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers").RuleOrDie(),
168+
169+
rbacv1helpers.NewRule(Write...).Groups(batchGroup).Resources("jobs", "cronjobs").RuleOrDie(),
170+
171+
rbacv1helpers.NewRule(Write...).Groups(extensionsGroup).Resources("daemonsets",
172+
"deployments", "deployments/scale", "deployments/rollback", "ingresses",
173+
"replicasets", "replicasets/scale", "replicationcontrollers/scale",
174+
"networkpolicies").RuleOrDie(),
175+
176+
rbacv1helpers.NewRule(Write...).Groups(policyGroup).Resources("poddisruptionbudgets").RuleOrDie(),
177+
178+
rbacv1helpers.NewRule(Write...).Groups(networkingGroup).Resources("networkpolicies", "ingresses").RuleOrDie(),
179+
180+
rbacv1helpers.NewRule(ReadWrite...).Groups(coordinationGroup).Resources("leases").RuleOrDie(),
181+
}
182+
if utilfeature.DefaultFeatureGate.Enabled(features.DynamicResourceAllocation) {
183+
rules = append(rules, rbacv1helpers.NewRule(Write...).Groups(resourceGroup).Resources("resourceclaims", "resourceclaimtemplates").RuleOrDie())
184+
}
185+
return rules
186+
}
187+
111188
// NodeRules returns node policy rules, it is slice of rbacv1.PolicyRule.
112189
func NodeRules() []rbacv1.PolicyRule {
113190
nodePolicyRules := []rbacv1.PolicyRule{
@@ -313,73 +390,13 @@ func ClusterRoles() []rbacv1.ClusterRole {
313390
// It does not grant powers for "privileged" resources which are domain of the system: `/status`
314391
// subresources or `quota`/`limits` which are used to control namespaces
315392
ObjectMeta: metav1.ObjectMeta{Name: "system:aggregate-to-edit", Labels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-edit": "true"}},
316-
Rules: []rbacv1.PolicyRule{
317-
// Allow read on escalating resources
318-
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("pods/attach", "pods/proxy", "pods/exec", "pods/portforward", "secrets", "services/proxy").RuleOrDie(),
319-
rbacv1helpers.NewRule("impersonate").Groups(legacyGroup).Resources("serviceaccounts").RuleOrDie(),
320-
321-
rbacv1helpers.NewRule(Write...).Groups(legacyGroup).Resources("pods", "pods/attach", "pods/proxy", "pods/exec", "pods/portforward").RuleOrDie(),
322-
rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("pods/eviction").RuleOrDie(),
323-
rbacv1helpers.NewRule(Write...).Groups(legacyGroup).Resources("replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts",
324-
"services", "services/proxy", "persistentvolumeclaims", "configmaps", "secrets", "events").RuleOrDie(),
325-
rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("serviceaccounts/token").RuleOrDie(),
326-
327-
rbacv1helpers.NewRule(Write...).Groups(appsGroup).Resources(
328-
"statefulsets", "statefulsets/scale",
329-
"daemonsets",
330-
"deployments", "deployments/scale", "deployments/rollback",
331-
"replicasets", "replicasets/scale").RuleOrDie(),
332-
333-
rbacv1helpers.NewRule(Write...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers").RuleOrDie(),
334-
335-
rbacv1helpers.NewRule(Write...).Groups(batchGroup).Resources("jobs", "cronjobs").RuleOrDie(),
336-
337-
rbacv1helpers.NewRule(Write...).Groups(extensionsGroup).Resources("daemonsets",
338-
"deployments", "deployments/scale", "deployments/rollback", "ingresses",
339-
"replicasets", "replicasets/scale", "replicationcontrollers/scale",
340-
"networkpolicies").RuleOrDie(),
341-
342-
rbacv1helpers.NewRule(Write...).Groups(policyGroup).Resources("poddisruptionbudgets").RuleOrDie(),
343-
344-
rbacv1helpers.NewRule(Write...).Groups(networkingGroup).Resources("networkpolicies", "ingresses").RuleOrDie(),
345-
346-
rbacv1helpers.NewRule(ReadWrite...).Groups(coordinationGroup).Resources("leases").RuleOrDie(),
347-
},
393+
Rules: editRules(),
348394
},
349395
{
350396
// a role for namespace level viewing. It grants Read-only access to non-escalating resources in
351397
// a namespace.
352398
ObjectMeta: metav1.ObjectMeta{Name: "system:aggregate-to-view", Labels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-view": "true"}},
353-
Rules: []rbacv1.PolicyRule{
354-
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("pods", "replicationcontrollers", "replicationcontrollers/scale", "serviceaccounts",
355-
"services", "services/status", "endpoints", "persistentvolumeclaims", "persistentvolumeclaims/status", "configmaps").RuleOrDie(),
356-
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("limitranges", "resourcequotas", "bindings", "events",
357-
"pods/status", "resourcequotas/status", "namespaces/status", "replicationcontrollers/status", "pods/log").RuleOrDie(),
358-
// read access to namespaces at the namespace scope means you can read *this* namespace. This can be used as an
359-
// indicator of which namespaces you have access to.
360-
rbacv1helpers.NewRule(Read...).Groups(legacyGroup).Resources("namespaces").RuleOrDie(),
361-
362-
rbacv1helpers.NewRule(Read...).Groups(discoveryGroup).Resources("endpointslices").RuleOrDie(),
363-
364-
rbacv1helpers.NewRule(Read...).Groups(appsGroup).Resources(
365-
"controllerrevisions",
366-
"statefulsets", "statefulsets/status", "statefulsets/scale",
367-
"daemonsets", "daemonsets/status",
368-
"deployments", "deployments/status", "deployments/scale",
369-
"replicasets", "replicasets/status", "replicasets/scale").RuleOrDie(),
370-
371-
rbacv1helpers.NewRule(Read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers", "horizontalpodautoscalers/status").RuleOrDie(),
372-
373-
rbacv1helpers.NewRule(Read...).Groups(batchGroup).Resources("jobs", "cronjobs", "cronjobs/status", "jobs/status").RuleOrDie(),
374-
375-
rbacv1helpers.NewRule(Read...).Groups(extensionsGroup).Resources("daemonsets", "daemonsets/status", "deployments", "deployments/scale", "deployments/status",
376-
"ingresses", "ingresses/status", "replicasets", "replicasets/scale", "replicasets/status", "replicationcontrollers/scale",
377-
"networkpolicies").RuleOrDie(),
378-
379-
rbacv1helpers.NewRule(Read...).Groups(policyGroup).Resources("poddisruptionbudgets", "poddisruptionbudgets/status").RuleOrDie(),
380-
381-
rbacv1helpers.NewRule(Read...).Groups(networkingGroup).Resources("networkpolicies", "ingresses", "ingresses/status").RuleOrDie(),
382-
},
399+
Rules: viewRules(),
383400
},
384401
{
385402
// a role to use for heapster's connections back to the API server

‎plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy_test.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ import (
3131
"k8s.io/apimachinery/pkg/api/meta"
3232
"k8s.io/apimachinery/pkg/runtime"
3333
"k8s.io/apimachinery/pkg/util/sets"
34+
"k8s.io/apiserver/pkg/util/feature"
35+
featuregatetesting "k8s.io/component-base/featuregate/testing"
3436
"k8s.io/component-helpers/auth/rbac/validation"
3537
"k8s.io/kubernetes/pkg/api/legacyscheme"
3638
api "k8s.io/kubernetes/pkg/apis/core"
@@ -175,6 +177,26 @@ func TestBootstrapClusterRoles(t *testing.T) {
175177
testObjects(t, list, "cluster-roles.yaml")
176178
}
177179

180+
func TestBootstrapClusterRolesWithFeatureGatesEnabled(t *testing.T) {
181+
featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, "AllAlpha", true)
182+
featuregatetesting.SetFeatureGateDuringTest(t, feature.DefaultFeatureGate, "AllBeta", true)
183+
184+
bootstrapRoles := bootstrappolicy.ClusterRoles()
185+
featureGateList := &api.List{}
186+
featureGateNames := sets.NewString()
187+
featureGateRoles := map[string]runtime.Object{}
188+
for i := range bootstrapRoles {
189+
role := bootstrapRoles[i]
190+
featureGateNames.Insert(role.Name)
191+
featureGateRoles[role.Name] = &role
192+
}
193+
for _, featureGateName := range featureGateNames.List() {
194+
featureGateList.Items = append(featureGateList.Items, featureGateRoles[featureGateName])
195+
}
196+
197+
testObjects(t, featureGateList, "cluster-roles-featuregates.yaml")
198+
}
199+
178200
func TestBootstrapClusterRoleBindings(t *testing.T) {
179201
list := &api.List{}
180202
names := sets.NewString()

0 commit comments

Comments
 (0)