ITQ/submariner-charts
1
0
Fork 0
mirror of https://github.com/submariner-io/submariner-charts.git synced 2026-09-22 06:10:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Backport: Reduce RBAC permissions

Browse Source 
Backported from 0.15.

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
This commit is contained in:
Tom Pantelis
2024-05-07 14:10:26 -04:00
committed by Thomas Pantelis
parent 32960dc622
commit 3c85245734
1 changed files with 164 additions and 377 deletions
Download Patch File Download Diff File Expand all files Collapse all files
submariner-operator/templates/rbac.yaml
+164 -377
View File
@@ -9,62 +9,78 @@ metadata:
chart: {{ template "submariner.chart" . }} chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }} app: {{ template "submariner.name" . }}
rules: rules:
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
- pods # For metrics
- services - services
- services/finalizers verbs:
- endpoints - get
- persistentvolumeclaims - create
- events - update
- configmaps - apiGroups:
- secrets - ""
verbs: resources:
- '*' # For syncing Secrets from the broker
- apiGroups: - secrets
- apps verbs:
resources: - get
- deployments - create
- daemonsets - update
- replicasets - delete
- statefulsets - apiGroups:
verbs: - apps
- '*' resources:
- apiGroups: - deployments
- monitoring.coreos.com - daemonsets
resources: verbs:
- servicemonitors - create
verbs: - delete
- get - get
- create - list
- apiGroups: - patch
- apps - update
resourceNames: - watch
- {{ template "submariner.fullname" . }} - apiGroups:
resources: - monitoring.coreos.com
- deployments/finalizers resources:
verbs: # Needed for openshift monitoring
- update - servicemonitors
- apiGroups: verbs:
- "" - get
resources: - create
- pods - apiGroups:
verbs: - apps
- get resourceNames:
- apiGroups: - {{ template "submariner.fullname" . }}
- apps resources:
resources: - deployments/finalizers
- replicasets verbs:
verbs: - update
- get - apiGroups:
- apiGroups: - submariner.io
- submariner.io resources:
resources: - brokers
- '*' - brokers/status
- servicediscoveries - submariners
verbs: - submariners/status
- '*' - servicediscoveries
- servicediscoveries/status
verbs:
- get
- list
- watch
- create
- update
- delete
- apiGroups:
- submariner.io
resources:
- gateways
verbs:
- get
- list
- watch
--- ---
kind: RoleBinding kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -93,86 +109,47 @@ metadata:
chart: {{ template "submariner.chart" . }} chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }} app: {{ template "submariner.name" . }}
rules: rules:
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
- pods - pods
- services verbs:
- services/finalizers - get
- endpoints - update
- persistentvolumeclaims - patch
- events - apiGroups:
- configmaps - submariner.io
- secrets resources:
verbs: - clusters
- '*' - endpoints
- apiGroups: - gateways
- apps verbs:
resources: - get
- deployments - list
- daemonsets - watch
- replicasets - create
- statefulsets - update
verbs: - delete
- '*' - apiGroups:
- apiGroups: - coordination.k8s.io
- monitoring.coreos.com resources:
resources: - leases
- servicemonitors verbs:
verbs: - get
- get - list
- create - watch
- apiGroups: - create
- apps - update
resourceNames: - delete
- submariner-operator - apiGroups:
resources: - ""
- deployments/finalizers resources:
verbs: # For leader election
- update - configmaps
- apiGroups: verbs:
- "" - get
resources: - create
- pods - update
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups:
- submariner.io
resources:
- '*'
- servicediscoveries
verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- delete
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding kind: RoleBinding
@@ -202,74 +179,13 @@ metadata:
chart: {{ template "submariner.chart" . }} chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }} app: {{ template "submariner.name" . }}
rules: rules:
- apiGroups:
- ""
resources:
- pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- submariner-operator
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- '*' - endpoints
- servicediscoveries
verbs: verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get - get
- list - list
- patch
- update
- watch - watch
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -300,76 +216,6 @@ metadata:
release: {{ .Release.Name | quote }} release: {{ .Release.Name | quote }}
chart: {{ template "submariner.chart" . }} chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }} app: {{ template "submariner.name" . }}
rules:
- apiGroups:
- ""
resources:
- pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- submariner-operator
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups:
- submariner.io
resources:
- '*'
- servicediscoveries
verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding kind: RoleBinding
@@ -400,9 +246,6 @@ metadata:
chart: {{ template "submariner.chart" . }} chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }} app: {{ template "submariner.name" . }}
rules: rules:
# submariner-operator updates the config map of core-dns to forward requests to
# clusterset.local to Lighthouse DNS, also looks at existing configmaps
# to figure out network settings
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
@@ -424,9 +267,10 @@ rules:
- update - update
- delete - delete
- watch - watch
- apiGroups: # pods, services and nodes are looked up to figure out network settings - apiGroups:
- "" - ""
resources: resources:
# Needed for network settings discovery
- pods - pods
- services - services
- nodes - nodes
@@ -440,31 +284,31 @@ rules:
- dnses - dnses
verbs: verbs:
- get - get
- list
- watch
- update - update
- apiGroups: - apiGroups:
- config.openshift.io - config.openshift.io
resources: resources:
# Needed for network settings discovery
- networks - networks
resourceNames:
- cluster
verbs: verbs:
- get - get
- list
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list
- watch
- apiGroups: - apiGroups:
- monitoring.coreos.com - monitoring.coreos.com
resources: resources:
# Needed for openshift monitoring
- servicemonitors - servicemonitors
verbs: verbs:
- get - get
- create - create
- apiGroups:
- apps
resources:
# Needed for Flannel CNI discovery
- daemonsets
verbs:
- list
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -523,21 +367,7 @@ rules:
- configmaps - configmaps
verbs: verbs:
- get - get
- list
- watch
- create
- update
- apiGroups: - apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- update
- delete
- apiGroups: # pods and services are looked up to figure out network settings
- "" - ""
resources: resources:
- pods - pods
@@ -547,32 +377,6 @@ rules:
- get - get
- list - list
- watch - watch
- apiGroups:
- operator.openshift.io
resources:
- dnses
verbs:
- get
- list
- watch
- update
- apiGroups:
- config.openshift.io
resources:
- networks
verbs:
- get
- list
- apiGroups:
- submariner.io
resources:
- endpoints
- gateways
- clusters
verbs:
- get
- list
- watch
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -605,56 +409,29 @@ rules:
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
- pods
- services
- configmaps - configmaps
verbs: verbs:
- get - get
- list - list
- watch
- update
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- update
- delete
- apiGroups: # pods and services are looked up to figure out network settings
- ""
resources:
- pods
- services
verbs:
- get
- list
- watch
- apiGroups:
- operator.openshift.io
resources:
- dnses
verbs:
- get
- list
- watch
- update
- apiGroups: - apiGroups:
- config.openshift.io - config.openshift.io
resources: resources:
- networks - networks
resourceNames:
- cluster
verbs: verbs:
- get - get
- list
- apiGroups: - apiGroups:
- "" - ""
resources:
- nodes
verbs: verbs:
- get - get
- list - list
- watch - watch
- update - update
resources:
- nodes
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -688,8 +465,6 @@ rules:
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
- pods
- namespaces
- nodes - nodes
- endpoints - endpoints
verbs: verbs:
@@ -697,6 +472,14 @@ rules:
- list - list
- watch - watch
- update - update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
@@ -711,8 +494,8 @@ rules:
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- endpoints
- clusters - clusters
- endpoints
verbs: verbs:
- get - get
- list - list
@@ -743,7 +526,7 @@ rules:
- apiGroups: - apiGroups:
- multicluster.x-k8s.io - multicluster.x-k8s.io
resources: resources:
- "serviceexports" - serviceexports
verbs: verbs:
- get - get
- list - list
@@ -798,7 +581,6 @@ rules:
- get - get
- list - list
- watch - watch
- update
- apiGroups: - apiGroups:
- discovery.k8s.io - discovery.k8s.io
resources: resources:
@@ -815,8 +597,8 @@ rules:
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- "gateways" - gateways
- "globalingressips" - globalingressips
verbs: verbs:
- get - get
- list - list
@@ -824,7 +606,8 @@ rules:
- apiGroups: - apiGroups:
- multicluster.x-k8s.io - multicluster.x-k8s.io
resources: resources:
- "*" - serviceimports
- serviceimports/status
verbs: verbs:
- create - create
- get - get
@@ -832,6 +615,20 @@ rules:
- watch - watch
- update - update
- delete - delete
- apiGroups:
- multicluster.x-k8s.io
resources:
- serviceexports
verbs:
- get
- list
- watch
- apiGroups:
- multicluster.x-k8s.io
resources:
- serviceexports/status
verbs:
- update
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -860,30 +657,23 @@ rules:
- "" - ""
resources: resources:
- services - services
- namespaces
- endpoints
verbs: verbs:
- get - get
- list - list
- watch - watch
- update
- apiGroups: - apiGroups:
- discovery.k8s.io - discovery.k8s.io
resources: resources:
- endpointslices - endpointslices
verbs: verbs:
- create
- get - get
- list - list
- watch - watch
- update
- delete
- deletecollection
- apiGroups: - apiGroups:
- submariner.io - submariner.io
resources: resources:
- "gateways" - gateways
- "submariners" - submariners
verbs: verbs:
- get - get
- list - list
@@ -891,14 +681,11 @@ rules:
- apiGroups: - apiGroups:
- multicluster.x-k8s.io - multicluster.x-k8s.io
resources: resources:
- "*" - serviceimports
verbs: verbs:
- create
- get - get
- list - list
- watch - watch
- update
- delete
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding