Skip to content

Commit 4514d35

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #18971 from enj/enj/i/disable_daemonset_carry/1536304,1501514
Automatic merge from submit-queue. UPSTREAM: <carry>: Remove write permissions on daemonsets from Kubernetes bootstrap policy Due to how daemonsets interact with the project node selector, we need to limit write access to them to the cluster admin. Bug 1536304 Bug 1501514 Signed-off-by: Monis Khan <[email protected]> /kind bug /assign @liggitt @deads2k @simo5 @smarterclayton @openshift/sig-security /cherrypick release-3.9
2 parents 756e15b + a42347b commit 4514d35

File tree

4 files changed

+106
-16
lines changed

4 files changed

+106
-16
lines changed

‎test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4857,7 +4857,6 @@ items:
48574857
- apiGroups:
48584858
- apps
48594859
resources:
4860-
- daemonsets
48614860
- deployments
48624861
- deployments/rollback
48634862
- deployments/scale
@@ -4873,6 +4872,14 @@ items:
48734872
- patch
48744873
- update
48754874
- watch
4875+
- apiGroups:
4876+
- apps
4877+
resources:
4878+
- daemonsets
4879+
verbs:
4880+
- get
4881+
- list
4882+
- watch
48764883
- apiGroups:
48774884
- autoscaling
48784885
resources:
@@ -4903,7 +4910,6 @@ items:
49034910
- apiGroups:
49044911
- extensions
49054912
resources:
4906-
- daemonsets
49074913
- deployments
49084914
- deployments/rollback
49094915
- deployments/scale
@@ -4920,6 +4926,14 @@ items:
49204926
- patch
49214927
- update
49224928
- watch
4929+
- apiGroups:
4930+
- extensions
4931+
resources:
4932+
- daemonsets
4933+
verbs:
4934+
- get
4935+
- list
4936+
- watch
49234937
- apiGroups:
49244938
- policy
49254939
resources:
@@ -5036,7 +5050,6 @@ items:
50365050
- apiGroups:
50375051
- apps
50385052
resources:
5039-
- daemonsets
50405053
- deployments
50415054
- deployments/rollback
50425055
- deployments/scale
@@ -5052,6 +5065,14 @@ items:
50525065
- patch
50535066
- update
50545067
- watch
5068+
- apiGroups:
5069+
- apps
5070+
resources:
5071+
- daemonsets
5072+
verbs:
5073+
- get
5074+
- list
5075+
- watch
50555076
- apiGroups:
50565077
- autoscaling
50575078
resources:
@@ -5082,7 +5103,6 @@ items:
50825103
- apiGroups:
50835104
- extensions
50845105
resources:
5085-
- daemonsets
50865106
- deployments
50875107
- deployments/rollback
50885108
- deployments/scale
@@ -5099,6 +5119,14 @@ items:
50995119
- patch
51005120
- update
51015121
- watch
5122+
- apiGroups:
5123+
- extensions
5124+
resources:
5125+
- daemonsets
5126+
verbs:
5127+
- get
5128+
- list
5129+
- watch
51025130
- apiGroups:
51035131
- policy
51045132
resources:

‎test/testdata/bootstrappolicy/bootstrap_policy_file.yaml

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5319,7 +5319,6 @@ items:
53195319
- apps
53205320
attributeRestrictions: null
53215321
resources:
5322-
- daemonsets
53235322
- deployments
53245323
- deployments/rollback
53255324
- deployments/scale
@@ -5335,6 +5334,15 @@ items:
53355334
- patch
53365335
- update
53375336
- watch
5337+
- apiGroups:
5338+
- apps
5339+
attributeRestrictions: null
5340+
resources:
5341+
- daemonsets
5342+
verbs:
5343+
- get
5344+
- list
5345+
- watch
53385346
- apiGroups:
53395347
- autoscaling
53405348
attributeRestrictions: null
@@ -5368,7 +5376,6 @@ items:
53685376
- extensions
53695377
attributeRestrictions: null
53705378
resources:
5371-
- daemonsets
53725379
- deployments
53735380
- deployments/rollback
53745381
- deployments/scale
@@ -5385,6 +5392,15 @@ items:
53855392
- patch
53865393
- update
53875394
- watch
5395+
- apiGroups:
5396+
- extensions
5397+
attributeRestrictions: null
5398+
resources:
5399+
- daemonsets
5400+
verbs:
5401+
- get
5402+
- list
5403+
- watch
53885404
- apiGroups:
53895405
- policy
53905406
attributeRestrictions: null
@@ -5510,7 +5526,6 @@ items:
55105526
- apps
55115527
attributeRestrictions: null
55125528
resources:
5513-
- daemonsets
55145529
- deployments
55155530
- deployments/rollback
55165531
- deployments/scale
@@ -5526,6 +5541,15 @@ items:
55265541
- patch
55275542
- update
55285543
- watch
5544+
- apiGroups:
5545+
- apps
5546+
attributeRestrictions: null
5547+
resources:
5548+
- daemonsets
5549+
verbs:
5550+
- get
5551+
- list
5552+
- watch
55295553
- apiGroups:
55305554
- autoscaling
55315555
attributeRestrictions: null
@@ -5559,7 +5583,6 @@ items:
55595583
- extensions
55605584
attributeRestrictions: null
55615585
resources:
5562-
- daemonsets
55635586
- deployments
55645587
- deployments/rollback
55655588
- deployments/scale
@@ -5576,6 +5599,15 @@ items:
55765599
- patch
55775600
- update
55785601
- watch
5602+
- apiGroups:
5603+
- extensions
5604+
attributeRestrictions: null
5605+
resources:
5606+
- daemonsets
5607+
verbs:
5608+
- get
5609+
- list
5610+
- watch
55795611
- apiGroups:
55805612
- policy
55815613
attributeRestrictions: null

‎vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go

Lines changed: 6 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml

Lines changed: 32 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)