Skip to content

Commit 21e04c5

Browse files
soltyshsoltysh
committed
Policy changes
1 parent 3709f50 commit 21e04c5

File tree

6 files changed

+150
-50
lines changed

6 files changed

+150
-50
lines changed

‎pkg/cmd/server/bootstrappolicy/policy.go

+4-5
Original file line numberDiff line numberDiff line change
@@ -141,8 +141,7 @@ func GetOpenshiftBootstrapClusterRoles() []rbac.ClusterRole {
141141

142142
rbac.NewRule(read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers", "horizontalpodautoscalers/status").RuleOrDie(),
143143

144-
// TODO do we still need scheduledjobs?
145-
rbac.NewRule(read...).Groups(batchGroup).Resources("jobs", "jobs/status", "scheduledjobs", "scheduledjobs/status", "cronjobs", "cronjobs/status").RuleOrDie(),
144+
rbac.NewRule(read...).Groups(batchGroup).Resources("jobs", "jobs/status", "cronjobs", "cronjobs/status").RuleOrDie(),
146145

147146
rbac.NewRule(read...).Groups(extensionsGroup).Resources("daemonsets", "daemonsets/status", "deployments", "deployments/scale",
148147
"deployments/status", "horizontalpodautoscalers", "horizontalpodautoscalers/status", "ingresses", "ingresses/status", "jobs", "jobs/status",
@@ -277,7 +276,7 @@ func GetOpenshiftBootstrapClusterRoles() []rbac.ClusterRole {
277276

278277
rbac.NewRule(readWrite...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers").RuleOrDie(),
279278

280-
rbac.NewRule(readWrite...).Groups(batchGroup).Resources("jobs", "scheduledjobs", "cronjobs").RuleOrDie(),
279+
rbac.NewRule(readWrite...).Groups(batchGroup).Resources("jobs", "cronjobs").RuleOrDie(),
281280

282281
rbac.NewRule(readWrite...).Groups(extensionsGroup).Resources("horizontalpodautoscalers", "replicationcontrollers/scale",
283282
"replicasets", "replicasets/scale", "deployments", "deployments/scale", "deployments/rollback", "networkpolicies").RuleOrDie(),
@@ -346,7 +345,7 @@ func GetOpenshiftBootstrapClusterRoles() []rbac.ClusterRole {
346345

347346
rbac.NewRule(readWrite...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers").RuleOrDie(),
348347

349-
rbac.NewRule(readWrite...).Groups(batchGroup).Resources("jobs", "scheduledjobs", "cronjobs").RuleOrDie(),
348+
rbac.NewRule(readWrite...).Groups(batchGroup).Resources("jobs", "cronjobs").RuleOrDie(),
350349

351350
rbac.NewRule(readWrite...).Groups(extensionsGroup).Resources("horizontalpodautoscalers", "replicationcontrollers/scale",
352351
"replicasets", "replicasets/scale", "deployments", "deployments/scale", "deployments/rollback").RuleOrDie(),
@@ -403,7 +402,7 @@ func GetOpenshiftBootstrapClusterRoles() []rbac.ClusterRole {
403402

404403
rbac.NewRule(read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers").RuleOrDie(),
405404

406-
rbac.NewRule(read...).Groups(batchGroup).Resources("jobs", "scheduledjobs", "cronjobs").RuleOrDie(),
405+
rbac.NewRule(read...).Groups(batchGroup).Resources("jobs", "cronjobs").RuleOrDie(),
407406

408407
rbac.NewRule(read...).Groups(extensionsGroup).Resources("horizontalpodautoscalers", "replicasets", "replicasets/scale",
409408
"deployments", "deployments/scale").RuleOrDie(),

‎pkg/cmd/server/bootstrappolicy/web_console_role_test.go

+2
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ var rolesToHide = sets.NewString(
5454
"system:sdn-manager",
5555
"system:sdn-reader",
5656
"system:webhook",
57+
"system:certificates.k8s.io:certificatesigningrequests:nodeclient",
58+
"system:certificates.k8s.io:certificatesigningrequests:selfnodeclient",
5759
)
5860

5961
func TestSystemOnlyRoles(t *testing.T) {

‎pkg/cmd/server/start/start_kube_controller_manager.go

-2
Original file line numberDiff line numberDiff line change
@@ -170,8 +170,6 @@ func newKubeControllerManager(kubeconfigFile, saPrivateKeyFile, saRootCAFile, po
170170
// these resources contain security information in their names, and we don't need to track them
171171
componentconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthaccesstokens"},
172172
componentconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthauthorizetokens"},
173-
// exposed already as cronjobs
174-
componentconfig.GroupResource{Group: "batch", Resource: "scheduledjobs"},
175173
// exposed already as extensions v1beta1 by other controllers
176174
componentconfig.GroupResource{Group: "apps", Resource: "deployments"},
177175
// exposed as autoscaling v1

‎test/testdata/bootstrappolicy/bootstrap_cluster_role_bindings.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,7 @@ items:
305305
apiGroup: rbac.authorization.k8s.io
306306
kind: ClusterRole
307307
name: system:node
308-
subjects: []
308+
subjects: null
309309
- apiVersion: rbac.authorization.k8s.io/v1beta1
310310
kind: ClusterRoleBinding
311311
metadata:
@@ -1133,6 +1133,6 @@ items:
11331133
apiGroup: rbac.authorization.k8s.io
11341134
kind: ClusterRole
11351135
name: system:node
1136-
subjects: []
1136+
subjects: null
11371137
kind: List
11381138
metadata: {}

‎test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml

+76-28
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,6 @@ items:
158158
- cronjobs/status
159159
- jobs
160160
- jobs/status
161-
- scheduledjobs
162-
- scheduledjobs/status
163161
verbs:
164162
- get
165163
- list
@@ -682,7 +680,6 @@ items:
682680
resources:
683681
- cronjobs
684682
- jobs
685-
- scheduledjobs
686683
verbs:
687684
- create
688685
- delete
@@ -1115,7 +1112,6 @@ items:
11151112
resources:
11161113
- cronjobs
11171114
- jobs
1118-
- scheduledjobs
11191115
verbs:
11201116
- create
11211117
- delete
@@ -1431,7 +1427,6 @@ items:
14311427
resources:
14321428
- cronjobs
14331429
- jobs
1434-
- scheduledjobs
14351430
verbs:
14361431
- get
14371432
- list
@@ -2710,7 +2705,7 @@ items:
27102705
rbac.authorization.kubernetes.io/autoupdate: "true"
27112706
creationTimestamp: null
27122707
name: system:replication-controller
2713-
rules: []
2708+
rules: null
27142709
- apiVersion: rbac.authorization.k8s.io/v1beta1
27152710
kind: ClusterRole
27162711
metadata:
@@ -2719,7 +2714,7 @@ items:
27192714
rbac.authorization.kubernetes.io/autoupdate: "true"
27202715
creationTimestamp: null
27212716
name: system:endpoint-controller
2722-
rules: []
2717+
rules: null
27232718
- apiVersion: rbac.authorization.k8s.io/v1beta1
27242719
kind: ClusterRole
27252720
metadata:
@@ -2728,7 +2723,7 @@ items:
27282723
rbac.authorization.kubernetes.io/autoupdate: "true"
27292724
creationTimestamp: null
27302725
name: system:replicaset-controller
2731-
rules: []
2726+
rules: null
27322727
- apiVersion: rbac.authorization.k8s.io/v1beta1
27332728
kind: ClusterRole
27342729
metadata:
@@ -2737,7 +2732,7 @@ items:
27372732
rbac.authorization.kubernetes.io/autoupdate: "true"
27382733
creationTimestamp: null
27392734
name: system:garbage-collector-controller
2740-
rules: []
2735+
rules: null
27412736
- apiVersion: rbac.authorization.k8s.io/v1beta1
27422737
kind: ClusterRole
27432738
metadata:
@@ -2746,7 +2741,7 @@ items:
27462741
rbac.authorization.kubernetes.io/autoupdate: "true"
27472742
creationTimestamp: null
27482743
name: system:job-controller
2749-
rules: []
2744+
rules: null
27502745
- apiVersion: rbac.authorization.k8s.io/v1beta1
27512746
kind: ClusterRole
27522747
metadata:
@@ -2755,7 +2750,7 @@ items:
27552750
rbac.authorization.kubernetes.io/autoupdate: "true"
27562751
creationTimestamp: null
27572752
name: system:hpa-controller
2758-
rules: []
2753+
rules: null
27592754
- apiVersion: rbac.authorization.k8s.io/v1beta1
27602755
kind: ClusterRole
27612756
metadata:
@@ -2764,7 +2759,7 @@ items:
27642759
rbac.authorization.kubernetes.io/autoupdate: "true"
27652760
creationTimestamp: null
27662761
name: system:daemonset-controller
2767-
rules: []
2762+
rules: null
27682763
- apiVersion: rbac.authorization.k8s.io/v1beta1
27692764
kind: ClusterRole
27702765
metadata:
@@ -2773,7 +2768,7 @@ items:
27732768
rbac.authorization.kubernetes.io/autoupdate: "true"
27742769
creationTimestamp: null
27752770
name: system:disruption-controller
2776-
rules: []
2771+
rules: null
27772772
- apiVersion: rbac.authorization.k8s.io/v1beta1
27782773
kind: ClusterRole
27792774
metadata:
@@ -2782,7 +2777,7 @@ items:
27822777
rbac.authorization.kubernetes.io/autoupdate: "true"
27832778
creationTimestamp: null
27842779
name: system:namespace-controller
2785-
rules: []
2780+
rules: null
27862781
- apiVersion: rbac.authorization.k8s.io/v1beta1
27872782
kind: ClusterRole
27882783
metadata:
@@ -2791,7 +2786,7 @@ items:
27912786
rbac.authorization.kubernetes.io/autoupdate: "true"
27922787
creationTimestamp: null
27932788
name: system:gc-controller
2794-
rules: []
2789+
rules: null
27952790
- apiVersion: rbac.authorization.k8s.io/v1beta1
27962791
kind: ClusterRole
27972792
metadata:
@@ -2800,7 +2795,7 @@ items:
28002795
rbac.authorization.kubernetes.io/autoupdate: "true"
28012796
creationTimestamp: null
28022797
name: system:certificate-signing-controller
2803-
rules: []
2798+
rules: null
28042799
- apiVersion: rbac.authorization.k8s.io/v1beta1
28052800
kind: ClusterRole
28062801
metadata:
@@ -2809,7 +2804,7 @@ items:
28092804
rbac.authorization.kubernetes.io/autoupdate: "true"
28102805
creationTimestamp: null
28112806
name: system:statefulset-controller
2812-
rules: []
2807+
rules: null
28132808
- apiVersion: rbac.authorization.k8s.io/v1beta1
28142809
kind: ClusterRole
28152810
metadata:
@@ -2818,7 +2813,7 @@ items:
28182813
rbac.authorization.kubernetes.io/autoupdate: "true"
28192814
creationTimestamp: null
28202815
name: system:build-controller
2821-
rules: []
2816+
rules: null
28222817
- apiVersion: rbac.authorization.k8s.io/v1beta1
28232818
kind: ClusterRole
28242819
metadata:
@@ -2827,7 +2822,7 @@ items:
28272822
rbac.authorization.kubernetes.io/autoupdate: "true"
28282823
creationTimestamp: null
28292824
name: system:deploymentconfig-controller
2830-
rules: []
2825+
rules: null
28312826
- apiVersion: rbac.authorization.k8s.io/v1beta1
28322827
kind: ClusterRole
28332828
metadata:
@@ -2836,7 +2831,7 @@ items:
28362831
rbac.authorization.kubernetes.io/autoupdate: "true"
28372832
creationTimestamp: null
28382833
name: system:deployment-controller
2839-
rules: []
2834+
rules: null
28402835
- apiVersion: rbac.authorization.k8s.io/v1beta1
28412836
kind: ClusterRole
28422837
metadata:
@@ -4256,18 +4251,21 @@ items:
42564251
- 'http:heapster:'
42574252
- 'https:heapster:'
42584253
resources:
4259-
- services
4254+
- services/proxy
42604255
verbs:
4261-
- proxy
4256+
- get
42624257
- apiGroups:
4263-
- ""
4264-
resourceNames:
4265-
- 'http:heapster:'
4266-
- 'https:heapster:'
4258+
- metrics.k8s.io
42674259
resources:
4268-
- services/proxy
4260+
- pods
42694261
verbs:
4270-
- get
4262+
- list
4263+
- apiGroups:
4264+
- custom.metrics.k8s.io
4265+
resources:
4266+
- '*'
4267+
verbs:
4268+
- list
42714269
- apiGroups:
42724270
- ""
42734271
resources:
@@ -4944,6 +4942,14 @@ items:
49444942
- get
49454943
- list
49464944
- watch
4945+
- apiGroups:
4946+
- extensions
4947+
resources:
4948+
- deployments
4949+
verbs:
4950+
- get
4951+
- list
4952+
- watch
49474953
- apiVersion: rbac.authorization.k8s.io/v1beta1
49484954
kind: ClusterRole
49494955
metadata:
@@ -5141,8 +5147,16 @@ items:
51415147
- ""
51425148
resources:
51435149
- nodes
5150+
verbs:
5151+
- get
5152+
- list
5153+
- watch
5154+
- apiGroups:
5155+
- ""
5156+
resources:
51445157
- pods
51455158
verbs:
5159+
- delete
51465160
- get
51475161
- list
51485162
- watch
@@ -5212,5 +5226,39 @@ items:
52125226
verbs:
52135227
- list
52145228
- watch
5229+
- apiVersion: rbac.authorization.k8s.io/v1beta1
5230+
kind: ClusterRole
5231+
metadata:
5232+
annotations:
5233+
authorization.openshift.io/system-only: "true"
5234+
rbac.authorization.kubernetes.io/autoupdate: "true"
5235+
creationTimestamp: null
5236+
labels:
5237+
kubernetes.io/bootstrapping: rbac-defaults
5238+
name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
5239+
rules:
5240+
- apiGroups:
5241+
- certificates.k8s.io
5242+
resources:
5243+
- certificatesigningrequests/nodeclient
5244+
verbs:
5245+
- create
5246+
- apiVersion: rbac.authorization.k8s.io/v1beta1
5247+
kind: ClusterRole
5248+
metadata:
5249+
annotations:
5250+
authorization.openshift.io/system-only: "true"
5251+
rbac.authorization.kubernetes.io/autoupdate: "true"
5252+
creationTimestamp: null
5253+
labels:
5254+
kubernetes.io/bootstrapping: rbac-defaults
5255+
name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
5256+
rules:
5257+
- apiGroups:
5258+
- certificates.k8s.io
5259+
resources:
5260+
- certificatesigningrequests/selfnodeclient
5261+
verbs:
5262+
- create
52155263
kind: List
52165264
metadata: {}

0 commit comments

Comments
 (0)