Skip to content

Commit b647c76

Browse files
deads2kdeads2k
authored
Merge pull request #18977 from openshift-cherrypick-robot/cherry-pick-18971-to-release-3.9
[release-3.9] UPSTREAM: <carry>: Remove write permissions on daemonsets from Kubernetes bootstrap policy
2 parents 379f583 + 8e32f77 commit b647c76

File tree

4 files changed

+106
-16
lines changed

4 files changed

+106
-16
lines changed

‎test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4818,7 +4818,6 @@ items:
48184818
- apiGroups:
48194819
- apps
48204820
resources:
4821-
- daemonsets
48224821
- deployments
48234822
- deployments/rollback
48244823
- deployments/scale
@@ -4834,6 +4833,14 @@ items:
48344833
- patch
48354834
- update
48364835
- watch
4836+
- apiGroups:
4837+
- apps
4838+
resources:
4839+
- daemonsets
4840+
verbs:
4841+
- get
4842+
- list
4843+
- watch
48374844
- apiGroups:
48384845
- autoscaling
48394846
resources:
@@ -4864,7 +4871,6 @@ items:
48644871
- apiGroups:
48654872
- extensions
48664873
resources:
4867-
- daemonsets
48684874
- deployments
48694875
- deployments/rollback
48704876
- deployments/scale
@@ -4881,6 +4887,14 @@ items:
48814887
- patch
48824888
- update
48834889
- watch
4890+
- apiGroups:
4891+
- extensions
4892+
resources:
4893+
- daemonsets
4894+
verbs:
4895+
- get
4896+
- list
4897+
- watch
48844898
- apiGroups:
48854899
- policy
48864900
resources:
@@ -4997,7 +5011,6 @@ items:
49975011
- apiGroups:
49985012
- apps
49995013
resources:
5000-
- daemonsets
50015014
- deployments
50025015
- deployments/rollback
50035016
- deployments/scale
@@ -5013,6 +5026,14 @@ items:
50135026
- patch
50145027
- update
50155028
- watch
5029+
- apiGroups:
5030+
- apps
5031+
resources:
5032+
- daemonsets
5033+
verbs:
5034+
- get
5035+
- list
5036+
- watch
50165037
- apiGroups:
50175038
- autoscaling
50185039
resources:
@@ -5043,7 +5064,6 @@ items:
50435064
- apiGroups:
50445065
- extensions
50455066
resources:
5046-
- daemonsets
50475067
- deployments
50485068
- deployments/rollback
50495069
- deployments/scale
@@ -5060,6 +5080,14 @@ items:
50605080
- patch
50615081
- update
50625082
- watch
5083+
- apiGroups:
5084+
- extensions
5085+
resources:
5086+
- daemonsets
5087+
verbs:
5088+
- get
5089+
- list
5090+
- watch
50635091
- apiGroups:
50645092
- policy
50655093
resources:

‎test/testdata/bootstrappolicy/bootstrap_policy_file.yaml

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5276,7 +5276,6 @@ items:
52765276
- apps
52775277
attributeRestrictions: null
52785278
resources:
5279-
- daemonsets
52805279
- deployments
52815280
- deployments/rollback
52825281
- deployments/scale
@@ -5292,6 +5291,15 @@ items:
52925291
- patch
52935292
- update
52945293
- watch
5294+
- apiGroups:
5295+
- apps
5296+
attributeRestrictions: null
5297+
resources:
5298+
- daemonsets
5299+
verbs:
5300+
- get
5301+
- list
5302+
- watch
52955303
- apiGroups:
52965304
- autoscaling
52975305
attributeRestrictions: null
@@ -5325,7 +5333,6 @@ items:
53255333
- extensions
53265334
attributeRestrictions: null
53275335
resources:
5328-
- daemonsets
53295336
- deployments
53305337
- deployments/rollback
53315338
- deployments/scale
@@ -5342,6 +5349,15 @@ items:
53425349
- patch
53435350
- update
53445351
- watch
5352+
- apiGroups:
5353+
- extensions
5354+
attributeRestrictions: null
5355+
resources:
5356+
- daemonsets
5357+
verbs:
5358+
- get
5359+
- list
5360+
- watch
53455361
- apiGroups:
53465362
- policy
53475363
attributeRestrictions: null
@@ -5467,7 +5483,6 @@ items:
54675483
- apps
54685484
attributeRestrictions: null
54695485
resources:
5470-
- daemonsets
54715486
- deployments
54725487
- deployments/rollback
54735488
- deployments/scale
@@ -5483,6 +5498,15 @@ items:
54835498
- patch
54845499
- update
54855500
- watch
5501+
- apiGroups:
5502+
- apps
5503+
attributeRestrictions: null
5504+
resources:
5505+
- daemonsets
5506+
verbs:
5507+
- get
5508+
- list
5509+
- watch
54865510
- apiGroups:
54875511
- autoscaling
54885512
attributeRestrictions: null
@@ -5516,7 +5540,6 @@ items:
55165540
- extensions
55175541
attributeRestrictions: null
55185542
resources:
5519-
- daemonsets
55205543
- deployments
55215544
- deployments/rollback
55225545
- deployments/scale
@@ -5533,6 +5556,15 @@ items:
55335556
- patch
55345557
- update
55355558
- watch
5559+
- apiGroups:
5560+
- extensions
5561+
attributeRestrictions: null
5562+
resources:
5563+
- daemonsets
5564+
verbs:
5565+
- get
5566+
- list
5567+
- watch
55365568
- apiGroups:
55375569
- policy
55385570
attributeRestrictions: null

‎vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go

Lines changed: 6 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml

Lines changed: 32 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)