Skip to content

Commit 91bbfec

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #20279 from mrogers950/aggregate-cr
Aggregate cluster-reader role
2 parents b801072 + b3cb4f9 commit 91bbfec

File tree

6 files changed

+116
-266
lines changed

6 files changed

+116
-266
lines changed

‎pkg/cmd/server/bootstrappolicy/all_test.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ const osClusterRoleAggregationPrefix = "system:openshift:"
1616
// this map must be manually kept up to date as we make changes to aggregation
1717
// we hard code this data with no constants because we cannot change the underlying values
1818
var expectedAggregationMap = map[string]sets.String{
19-
"admin": sets.NewString("system:openshift:aggregate-to-admin", "system:aggregate-to-admin"),
20-
"edit": sets.NewString("system:openshift:aggregate-to-edit", "system:aggregate-to-edit"),
21-
"view": sets.NewString("system:openshift:aggregate-to-view", "system:aggregate-to-view"),
19+
"admin": sets.NewString("system:openshift:aggregate-to-admin", "system:aggregate-to-admin"),
20+
"edit": sets.NewString("system:openshift:aggregate-to-edit", "system:aggregate-to-edit"),
21+
"view": sets.NewString("system:openshift:aggregate-to-view", "system:aggregate-to-view"),
22+
"cluster-reader": sets.NewString("system:openshift:aggregate-to-view", "system:aggregate-to-view", "system:openshift:aggregate-to-cluster-reader"),
2223
}
2324

2425
func TestPolicyAggregation(t *testing.T) {

‎pkg/cmd/server/bootstrappolicy/constants.go

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -53,22 +53,23 @@ const (
5353

5454
// Roles
5555
const (
56-
ClusterAdminRoleName = "cluster-admin"
57-
SudoerRoleName = "sudoer"
58-
ScopeImpersonationRoleName = "system:scope-impersonation"
59-
ClusterReaderRoleName = "cluster-reader"
60-
StorageAdminRoleName = "storage-admin"
61-
ClusterDebuggerRoleName = "cluster-debugger"
62-
AdminRoleName = "admin"
63-
EditRoleName = "edit"
64-
ViewRoleName = "view"
65-
AggregatedAdminRoleName = "system:openshift:aggregate-to-admin"
66-
AggregatedEditRoleName = "system:openshift:aggregate-to-edit"
67-
AggregatedViewRoleName = "system:openshift:aggregate-to-view"
68-
SelfProvisionerRoleName = "self-provisioner"
69-
BasicUserRoleName = "basic-user"
70-
StatusCheckerRoleName = "cluster-status"
71-
SelfAccessReviewerRoleName = "self-access-reviewer"
56+
ClusterAdminRoleName = "cluster-admin"
57+
SudoerRoleName = "sudoer"
58+
ScopeImpersonationRoleName = "system:scope-impersonation"
59+
ClusterReaderRoleName = "cluster-reader"
60+
StorageAdminRoleName = "storage-admin"
61+
ClusterDebuggerRoleName = "cluster-debugger"
62+
AdminRoleName = "admin"
63+
EditRoleName = "edit"
64+
ViewRoleName = "view"
65+
AggregatedAdminRoleName = "system:openshift:aggregate-to-admin"
66+
AggregatedEditRoleName = "system:openshift:aggregate-to-edit"
67+
AggregatedViewRoleName = "system:openshift:aggregate-to-view"
68+
AggregatedClusterReaderRoleName = "system:openshift:aggregate-to-cluster-reader"
69+
SelfProvisionerRoleName = "self-provisioner"
70+
BasicUserRoleName = "basic-user"
71+
StatusCheckerRoleName = "cluster-status"
72+
SelfAccessReviewerRoleName = "self-access-reviewer"
7273

7374
RegistryAdminRoleName = "registry-admin"
7475
RegistryViewerRoleName = "registry-viewer"

‎pkg/cmd/server/bootstrappolicy/policy.go

Lines changed: 48 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -135,35 +135,46 @@ func GetOpenshiftBootstrapClusterRoles() []rbacv1.ClusterRole {
135135
ObjectMeta: metav1.ObjectMeta{
136136
Name: ClusterReaderRoleName,
137137
},
138+
AggregationRule: &rbacv1.AggregationRule{
139+
ClusterRoleSelectors: []metav1.LabelSelector{
140+
{
141+
MatchLabels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-cluster-reader": "true"},
142+
},
143+
{
144+
MatchLabels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-view": "true"},
145+
},
146+
},
147+
},
148+
},
149+
{
150+
ObjectMeta: metav1.ObjectMeta{
151+
Name: AggregatedClusterReaderRoleName,
152+
Labels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-cluster-reader": "true"},
153+
},
138154
Rules: []rbacv1.PolicyRule{
139-
rbacv1helpers.NewRule(read...).Groups(kapiGroup).Resources("bindings", "componentstatuses", "configmaps", "endpoints", "events", "limitranges",
140-
"namespaces", "namespaces/status", "nodes", "nodes/status", "persistentvolumeclaims", "persistentvolumeclaims/status", "persistentvolumes",
141-
"persistentvolumes/status", "pods", "pods/binding", "pods/eviction", "pods/log", "pods/status", "podtemplates", "replicationcontrollers", "replicationcontrollers/scale",
142-
"replicationcontrollers/status", "resourcequotas", "resourcequotas/status", "securitycontextconstraints", "serviceaccounts", "services",
143-
"services/status").RuleOrDie(),
155+
rbacv1helpers.NewRule(read...).Groups(kapiGroup).Resources("componentstatuses", "nodes", "nodes/status", "persistentvolumeclaims/status", "persistentvolumes",
156+
"persistentvolumes/status", "pods/binding", "pods/eviction", "podtemplates", "securitycontextconstraints", "services/status").RuleOrDie(),
144157

145158
rbacv1helpers.NewRule(read...).Groups(admissionRegistrationGroup).Resources("mutatingwebhookconfigurations", "validatingwebhookconfigurations").RuleOrDie(),
146159

147-
rbacv1helpers.NewRule(read...).Groups(appsGroup).Resources("statefulsets", "statefulsets/scale", "statefulsets/status", "deployments", "deployments/scale", "deployments/status", "controllerrevisions", "daemonsets", "daemonsets/status", "replicasets", "replicasets/status", "replicasets/scale").RuleOrDie(),
160+
rbacv1helpers.NewRule(read...).Groups(appsGroup).Resources("statefulsets/status", "deployments/status", "controllerrevisions", "daemonsets/status",
161+
"replicasets/status").RuleOrDie(),
148162

149163
rbacv1helpers.NewRule(read...).Groups(apiExtensionsGroup).Resources("customresourcedefinitions", "customresourcedefinitions/status").RuleOrDie(),
150164

151165
rbacv1helpers.NewRule(read...).Groups(apiRegistrationGroup).Resources("apiservices", "apiservices/status").RuleOrDie(),
152166

153-
rbacv1helpers.NewRule(read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers", "horizontalpodautoscalers/status").RuleOrDie(),
167+
rbacv1helpers.NewRule(read...).Groups(autoscalingGroup).Resources("horizontalpodautoscalers/status").RuleOrDie(),
154168

155-
rbacv1helpers.NewRule(read...).Groups(batchGroup).Resources("jobs", "jobs/status", "cronjobs", "cronjobs/status").RuleOrDie(),
169+
rbacv1helpers.NewRule(read...).Groups(batchGroup).Resources("jobs/status", "cronjobs/status").RuleOrDie(),
156170

157-
rbacv1helpers.NewRule(read...).Groups(extensionsGroup).Resources("daemonsets", "daemonsets/status", "deployments", "deployments/scale",
158-
"deployments/status", "horizontalpodautoscalers", "horizontalpodautoscalers/status", "ingresses", "ingresses/status", "jobs", "jobs/status",
159-
"networkpolicies", "podsecuritypolicies", "replicasets", "replicasets/scale", "replicasets/status", "replicationcontrollers",
160-
"replicationcontrollers/scale", "storageclasses", "thirdpartyresources").RuleOrDie(),
171+
rbacv1helpers.NewRule(read...).Groups(extensionsGroup).Resources("daemonsets/status", "deployments/status", "horizontalpodautoscalers",
172+
"horizontalpodautoscalers/status", "ingresses/status", "jobs", "jobs/status", "podsecuritypolicies", "replicasets/status", "replicationcontrollers",
173+
"storageclasses", "thirdpartyresources").RuleOrDie(),
161174

162175
rbacv1helpers.NewRule(read...).Groups(eventsGroup).Resources("events").RuleOrDie(),
163176

164-
rbacv1helpers.NewRule(read...).Groups(networkingGroup).Resources("networkpolicies").RuleOrDie(),
165-
166-
rbacv1helpers.NewRule(read...).Groups(policyGroup).Resources("podsecuritypolicies", "poddisruptionbudgets", "poddisruptionbudgets/status").RuleOrDie(),
177+
rbacv1helpers.NewRule(read...).Groups(policyGroup).Resources("podsecuritypolicies", "poddisruptionbudgets/status").RuleOrDie(),
167178

168179
rbacv1helpers.NewRule(read...).Groups(rbacGroup).Resources("roles", "rolebindings", "clusterroles", "clusterrolebindings").RuleOrDie(),
169180

@@ -173,56 +184,53 @@ func GetOpenshiftBootstrapClusterRoles() []rbacv1.ClusterRole {
173184

174185
rbacv1helpers.NewRule(read...).Groups(schedulingGroup).Resources("priorityclasses").RuleOrDie(),
175186

176-
rbacv1helpers.NewRule(read...).Groups(certificatesGroup).Resources("certificatesigningrequests", "certificatesigningrequests/approval", "certificatesigningrequests/status").RuleOrDie(),
187+
rbacv1helpers.NewRule(read...).Groups(certificatesGroup).Resources("certificatesigningrequests", "certificatesigningrequests/approval",
188+
"certificatesigningrequests/status").RuleOrDie(),
177189

178-
rbacv1helpers.NewRule(read...).Groups(authzGroup, legacyAuthzGroup).Resources("clusterroles", "clusterrolebindings", "roles", "rolebindings", "rolebindingrestrictions").RuleOrDie(),
190+
rbacv1helpers.NewRule(read...).Groups(authzGroup, legacyAuthzGroup).Resources("clusterroles", "clusterrolebindings", "roles", "rolebindings",
191+
"rolebindingrestrictions").RuleOrDie(),
179192

180-
rbacv1helpers.NewRule(read...).Groups(buildGroup, legacyBuildGroup).Resources("builds", "builds/details", "buildconfigs", "buildconfigs/webhooks", "builds/log").RuleOrDie(),
193+
rbacv1helpers.NewRule(read...).Groups(buildGroup, legacyBuildGroup).Resources("builds/details").RuleOrDie(),
181194

182-
rbacv1helpers.NewRule(read...).Groups(deployGroup, legacyDeployGroup).Resources("deploymentconfigs", "deploymentconfigs/scale", "deploymentconfigs/log",
183-
"deploymentconfigs/status").RuleOrDie(),
184-
185-
rbacv1helpers.NewRule(read...).Groups(imageGroup, legacyImageGroup).Resources("images", "imagesignatures", "imagestreams", "imagestreamtags", "imagestreamimages",
186-
"imagestreams/status").RuleOrDie(),
195+
rbacv1helpers.NewRule(read...).Groups(imageGroup, legacyImageGroup).Resources("images", "imagesignatures").RuleOrDie(),
187196
// pull images
188197
rbacv1helpers.NewRule("get").Groups(imageGroup, legacyImageGroup).Resources("imagestreams/layers").RuleOrDie(),
189198

190199
rbacv1helpers.NewRule(read...).Groups(oauthGroup, legacyOauthGroup).Resources("oauthclientauthorizations").RuleOrDie(),
191200

192-
rbacv1helpers.NewRule(read...).Groups(projectGroup, legacyProjectGroup).Resources("projectrequests", "projects").RuleOrDie(),
201+
// "get" comes in from aggregate-to-view role
202+
rbacv1helpers.NewRule("list", "watch").Groups(projectGroup, legacyProjectGroup).Resources("projects").RuleOrDie(),
193203

194-
rbacv1helpers.NewRule(read...).Groups(quotaGroup, legacyQuotaGroup).Resources("appliedclusterresourcequotas", "clusterresourcequotas", "clusterresourcequotas/status").RuleOrDie(),
204+
rbacv1helpers.NewRule(read...).Groups(projectGroup, legacyProjectGroup).Resources("projectrequests").RuleOrDie(),
195205

196-
rbacv1helpers.NewRule(read...).Groups(routeGroup, legacyRouteGroup).Resources("routes", "routes/status").RuleOrDie(),
206+
rbacv1helpers.NewRule(read...).Groups(quotaGroup, legacyQuotaGroup).Resources("clusterresourcequotas", "clusterresourcequotas/status").RuleOrDie(),
197207

198-
rbacv1helpers.NewRule(read...).Groups(networkGroup, legacyNetworkGroup).Resources("clusternetworks", "egressnetworkpolicies", "hostsubnets", "netnamespaces").RuleOrDie(),
208+
rbacv1helpers.NewRule(read...).Groups(networkGroup, legacyNetworkGroup).Resources("clusternetworks", "egressnetworkpolicies", "hostsubnets",
209+
"netnamespaces").RuleOrDie(),
199210

200211
rbacv1helpers.NewRule(read...).Groups(securityGroup, legacySecurityGroup).Resources("securitycontextconstraints").RuleOrDie(),
201212
rbacv1helpers.NewRule(read...).Groups(securityGroup).Resources("rangeallocations").RuleOrDie(),
202213

203-
rbacv1helpers.NewRule(read...).Groups(templateGroup, legacyTemplateGroup).Resources("templates", "templateconfigs", "processedtemplates", "templateinstances").RuleOrDie(),
204214
rbacv1helpers.NewRule(read...).Groups(templateGroup, legacyTemplateGroup).Resources("brokertemplateinstances", "templateinstances/status").RuleOrDie(),
205215

206216
rbacv1helpers.NewRule(read...).Groups(userGroup, legacyUserGroup).Resources("groups", "identities", "useridentitymappings", "users").RuleOrDie(),
207217

208218
// permissions to check access. These creates are non-mutating
209-
rbacv1helpers.NewRule("create").Groups(authzGroup, legacyAuthzGroup).Resources("localresourceaccessreviews", "localsubjectaccessreviews", "resourceaccessreviews",
210-
"selfsubjectrulesreviews", "subjectrulesreviews", "subjectaccessreviews").RuleOrDie(),
211-
rbacv1helpers.NewRule("create").Groups(kAuthzGroup).Resources("selfsubjectaccessreviews", "subjectaccessreviews", "selfsubjectrulesreviews", "localsubjectaccessreviews").RuleOrDie(),
219+
rbacv1helpers.NewRule("create").Groups(authzGroup, legacyAuthzGroup).Resources("localresourceaccessreviews", "localsubjectaccessreviews",
220+
"resourceaccessreviews", "selfsubjectrulesreviews", "subjectrulesreviews", "subjectaccessreviews").RuleOrDie(),
221+
rbacv1helpers.NewRule("create").Groups(kAuthzGroup).Resources("selfsubjectaccessreviews", "subjectaccessreviews", "selfsubjectrulesreviews",
222+
"localsubjectaccessreviews").RuleOrDie(),
212223
rbacv1helpers.NewRule("create").Groups(kAuthnGroup).Resources("tokenreviews").RuleOrDie(),
213224
// permissions to check PSP, these creates are non-mutating
214-
rbacv1helpers.NewRule("create").Groups(securityGroup, legacySecurityGroup).Resources("podsecuritypolicysubjectreviews", "podsecuritypolicyselfsubjectreviews", "podsecuritypolicyreviews").RuleOrDie(),
225+
rbacv1helpers.NewRule("create").Groups(securityGroup, legacySecurityGroup).Resources("podsecuritypolicysubjectreviews",
226+
"podsecuritypolicyselfsubjectreviews", "podsecuritypolicyreviews").RuleOrDie(),
215227
// Allow read access to node metrics
216228
rbacv1helpers.NewRule("get").Groups(kapiGroup).Resources("nodes/"+NodeMetricsSubresource, "nodes/"+NodeSpecSubresource).RuleOrDie(),
217229
// Allow read access to stats
218230
// Node stats requests are submitted as POSTs. These creates are non-mutating
219231
rbacv1helpers.NewRule("get", "create").Groups(kapiGroup).Resources("nodes/" + NodeStatsSubresource).RuleOrDie(),
220232

221233
rbacv1helpers.NewRule("get").URLs(rbac.NonResourceAll).RuleOrDie(),
222-
223-
// backwards compatibility
224-
rbacv1helpers.NewRule(read...).Groups(buildGroup, legacyBuildGroup).Resources("buildlogs").RuleOrDie(),
225-
rbacv1helpers.NewRule(read...).Groups(kapiGroup).Resources("resourcequotausages").RuleOrDie(),
226234
},
227235
},
228236
{
@@ -1014,8 +1022,9 @@ func GetBootstrapNamespaceRoleBindings() map[string][]rbacv1.RoleBinding {
10141022

10151023
func GetBootstrapClusterRolesToAggregate() map[string]string {
10161024
return map[string]string{
1017-
AdminRoleName: AggregatedAdminRoleName,
1018-
EditRoleName: AggregatedEditRoleName,
1019-
ViewRoleName: AggregatedViewRoleName,
1025+
AdminRoleName: AggregatedAdminRoleName,
1026+
EditRoleName: AggregatedEditRoleName,
1027+
ViewRoleName: AggregatedViewRoleName,
1028+
ClusterReaderRoleName: AggregatedClusterReaderRoleName,
10201029
}
10211030
}

‎pkg/cmd/server/bootstrappolicy/web_console_role_test.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ var rolesToHide = sets.NewString(
6565
"system:openshift:aggregate-to-admin",
6666
"system:openshift:aggregate-to-edit",
6767
"system:openshift:aggregate-to-view",
68+
"system:openshift:aggregate-to-cluster-reader",
6869
"system:kubelet-api-admin",
6970
"system:volume-scheduler",
7071
)

0 commit comments

Comments
 (0)