ITQ/submariner-charts
1
0
Fork 0
mirror of https://github.com/submariner-io/submariner-charts.git synced 2026-09-22 14:20:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Backport: Reduce RBAC permissions

Browse Source 
Backported from 0.15.

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
This commit is contained in:
Tom Pantelis
2024-05-07 14:10:26 -04:00
committed by Thomas Pantelis
parent 32960dc622
commit 3c85245734
1 changed files with 164 additions and 377 deletions
Download Patch File Download Diff File Expand all files Collapse all files
submariner-operator/templates/rbac.yaml
+104 -317
View File
@@ -12,28 +12,39 @@ rules:
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
- pods # For metrics
- services - services
- services/finalizers verbs:
- endpoints - get
- persistentvolumeclaims - create
- events - update
- configmaps - apiGroups:
- ""
resources:
# For syncing Secrets from the broker
- secrets - secrets
verbs: verbs:
- '*' - get
- create
- update
- delete
- apiGroups: - apiGroups:
- apps - apps
resources: resources:
- deployments - deployments
- daemonsets - daemonsets
- replicasets
- statefulsets
verbs: verbs:
- '*' - create
- delete
- get
- list
- patch
- update
- watch
- apiGroups: - apiGroups:
- monitoring.coreos.com - monitoring.coreos.com
resources: resources:
# Needed for openshift monitoring
- servicemonitors - servicemonitors
verbs: verbs:
- get - get
@@ -47,24 +58,29 @@ rules:
verbs: verbs:
- update - update
- apiGroups: - apiGroups:
- "" - submariner.io
resources: resources:
- pods - brokers
verbs: - brokers/status
- get - submariners
- apiGroups: - submariners/status
- apps - servicediscoveries
resources: - servicediscoveries/status
- replicasets
verbs: verbs:
- get - get
- list
- watch
- create
- update
- delete
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- '*' - gateways
- servicediscoveries
verbs: verbs:
- '*' - get
- list
- watch
--- ---
kind: RoleBinding kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -97,71 +113,23 @@ rules:
- "" - ""
resources: resources:
- pods - pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs: verbs:
- get - get
- create
- apiGroups:
- apps
resourceNames:
- submariner-operator
resources:
- deployments/finalizers
verbs:
- update - update
- apiGroups: - patch
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- '*' - clusters
- servicediscoveries - endpoints
- gateways
verbs: verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get - get
- list - list
- patch
- update
- watch - watch
- create
- update
- delete
- apiGroups: - apiGroups:
- coordination.k8s.io - coordination.k8s.io
resources: resources:
@@ -173,6 +141,15 @@ rules:
- create - create
- update - update
- delete - delete
- apiGroups:
- ""
resources:
# For leader election
- configmaps
verbs:
- get
- create
- update
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding kind: RoleBinding
@@ -202,74 +179,13 @@ metadata:
chart: {{ template "submariner.chart" . }} chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }} app: {{ template "submariner.name" . }}
rules: rules:
- apiGroups:
- ""
resources:
- pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- submariner-operator
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- '*' - endpoints
- servicediscoveries
verbs: verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get - get
- list - list
- patch
- update
- watch - watch
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -300,76 +216,6 @@ metadata:
release: {{ .Release.Name | quote }} release: {{ .Release.Name | quote }}
chart: {{ template "submariner.chart" . }} chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }} app: {{ template "submariner.name" . }}
rules:
- apiGroups:
- ""
resources:
- pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- submariner-operator
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups:
- submariner.io
resources:
- '*'
- servicediscoveries
verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding kind: RoleBinding
@@ -400,9 +246,6 @@ metadata:
chart: {{ template "submariner.chart" . }} chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }} app: {{ template "submariner.name" . }}
rules: rules:
# submariner-operator updates the config map of core-dns to forward requests to
# clusterset.local to Lighthouse DNS, also looks at existing configmaps
# to figure out network settings
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
@@ -424,9 +267,10 @@ rules:
- update - update
- delete - delete
- watch - watch
- apiGroups: # pods, services and nodes are looked up to figure out network settings - apiGroups:
- "" - ""
resources: resources:
# Needed for network settings discovery
- pods - pods
- services - services
- nodes - nodes
@@ -440,31 +284,31 @@ rules:
- dnses - dnses
verbs: verbs:
- get - get
- list
- watch
- update - update
- apiGroups: - apiGroups:
- config.openshift.io - config.openshift.io
resources: resources:
# Needed for network settings discovery
- networks - networks
resourceNames:
- cluster
verbs: verbs:
- get - get
- list
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list
- watch
- apiGroups: - apiGroups:
- monitoring.coreos.com - monitoring.coreos.com
resources: resources:
# Needed for openshift monitoring
- servicemonitors - servicemonitors
verbs: verbs:
- get - get
- create - create
- apiGroups:
- apps
resources:
# Needed for Flannel CNI discovery
- daemonsets
verbs:
- list
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -523,21 +367,7 @@ rules:
- configmaps - configmaps
verbs: verbs:
- get - get
- list
- watch
- create
- update
- apiGroups: - apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- update
- delete
- apiGroups: # pods and services are looked up to figure out network settings
- "" - ""
resources: resources:
- pods - pods
@@ -547,32 +377,6 @@ rules:
- get - get
- list - list
- watch - watch
- apiGroups:
- operator.openshift.io
resources:
- dnses
verbs:
- get
- list
- watch
- update
- apiGroups:
- config.openshift.io
resources:
- networks
verbs:
- get
- list
- apiGroups:
- submariner.io
resources:
- endpoints
- gateways
- clusters
verbs:
- get
- list
- watch
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -605,56 +409,29 @@ rules:
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
- pods
- services
- configmaps - configmaps
verbs: verbs:
- get - get
- list - list
- watch
- update
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- update
- delete
- apiGroups: # pods and services are looked up to figure out network settings
- ""
resources:
- pods
- services
verbs:
- get
- list
- watch
- apiGroups:
- operator.openshift.io
resources:
- dnses
verbs:
- get
- list
- watch
- update
- apiGroups: - apiGroups:
- config.openshift.io - config.openshift.io
resources: resources:
- networks - networks
resourceNames:
- cluster
verbs: verbs:
- get - get
- list
- apiGroups: - apiGroups:
- "" - ""
resources:
- nodes
verbs: verbs:
- get - get
- list - list
- watch - watch
- update - update
resources:
- nodes
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -688,8 +465,6 @@ rules:
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
- pods
- namespaces
- nodes - nodes
- endpoints - endpoints
verbs: verbs:
@@ -697,6 +472,14 @@ rules:
- list - list
- watch - watch
- update - update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
@@ -711,8 +494,8 @@ rules:
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- endpoints
- clusters - clusters
- endpoints
verbs: verbs:
- get - get
- list - list
@@ -743,7 +526,7 @@ rules:
- apiGroups: - apiGroups:
- multicluster.x-k8s.io - multicluster.x-k8s.io
resources: resources:
- "serviceexports" - serviceexports
verbs: verbs:
- get - get
- list - list
@@ -798,7 +581,6 @@ rules:
- get - get
- list - list
- watch - watch
- update
- apiGroups: - apiGroups:
- discovery.k8s.io - discovery.k8s.io
resources: resources:
@@ -815,8 +597,8 @@ rules:
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- "gateways" - gateways
- "globalingressips" - globalingressips
verbs: verbs:
- get - get
- list - list
@@ -824,7 +606,8 @@ rules:
- apiGroups: - apiGroups:
- multicluster.x-k8s.io - multicluster.x-k8s.io
resources: resources:
- "*" - serviceimports
- serviceimports/status
verbs: verbs:
- create - create
- get - get
@@ -832,6 +615,20 @@ rules:
- watch - watch
- update - update
- delete - delete
- apiGroups:
- multicluster.x-k8s.io
resources:
- serviceexports
verbs:
- get
- list
- watch
- apiGroups:
- multicluster.x-k8s.io
resources:
- serviceexports/status
verbs:
- update
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -860,30 +657,23 @@ rules:
- "" - ""
resources: resources:
- services - services
- namespaces
- endpoints
verbs: verbs:
- get - get
- list - list
- watch - watch
- update
- apiGroups: - apiGroups:
- discovery.k8s.io - discovery.k8s.io
resources: resources:
- endpointslices - endpointslices
verbs: verbs:
- create
- get - get
- list - list
- watch - watch
- update
- delete
- deletecollection
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- "gateways" - gateways
- "submariners" - submariners
verbs: verbs:
- get - get
- list - list
@@ -891,14 +681,11 @@ rules:
- apiGroups: - apiGroups:
- multicluster.x-k8s.io - multicluster.x-k8s.io
resources: resources:
- "*" - serviceimports
verbs: verbs:
- create
- get - get
- list - list
- watch - watch
- update
- delete
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding