public_git/kubernetes-operator
1
0
Fork 0
mirror of https://github.com/jenkinsci/kubernetes-operator.git synced 2026-10-05 23:51:12 +02:00
Code Issues Releases Wiki Activity

Default rule policy now allows watching resources required by OpenShift (#352)

Browse Source
This commit is contained in:
Akram Ben Aissi
2020-04-28 16:45:30 +02:00
committed by GitHub
parent fe9cb921bc
commit 83b3fa8cd0
3 changed files with 129 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/controller/jenkins/configuration/base/resources/rbac.go
+49 -34
View File
@@ -6,50 +6,29 @@ import (
)
const (
createVerb = "create"
deleteVerb = "delete"
getVerb = "get"
listVerb = "list"
watchVerb = "watch"
patchVerb = "patch"
updateVerb = "update"
createVerb = "create"
deleteVerb = "delete"
getVerb = "get"
listVerb = "list"
watchVerb = "watch"
patchVerb = "patch"
updateVerb = "update"
EmptyApiGroups = ""
OpenshiftApiGroup = "image.openshift.io"
BuildApiGroup = "build.openshift.io"
)
// NewRole returns rbac role for jenkins master
func NewRole(meta metav1.ObjectMeta) *v1.Role {
rules := NewDefaultPolicyRules()
return &v1.Role{
TypeMeta: metav1.TypeMeta{
Kind: "Role",
APIVersion: "rbac.authorization.k8s.io/v1",
},
ObjectMeta: meta,
Rules: []v1.PolicyRule{
{
APIGroups: []string{""},
Resources: []string{"pods/portforward"},
Verbs: []string{createVerb},
},
{
APIGroups: []string{""},
Resources: []string{"pods"},
Verbs: []string{createVerb, deleteVerb, getVerb, listVerb, patchVerb, updateVerb, watchVerb},
},
{
APIGroups: []string{""},
Resources: []string{"pods/exec"},
Verbs: []string{createVerb, deleteVerb, getVerb, listVerb, patchVerb, updateVerb, watchVerb},
},
{
APIGroups: []string{""},
Resources: []string{"pods/log"},
Verbs: []string{getVerb, listVerb, watchVerb},
},
{
APIGroups: []string{""},
Resources: []string{"secrets"},
Verbs: []string{getVerb, listVerb, watchVerb},
},
},
Rules: rules,
}
}
@@ -74,3 +53,39 @@ func NewRoleBinding(name, namespace, serviceAccountName string, roleRef v1.RoleR
},
}
}
func NewDefaultPolicyRules() []v1.PolicyRule {
var rules []v1.PolicyRule
ReadOnly := []string{getVerb, listVerb, watchVerb}
Default := []string{createVerb, deleteVerb, getVerb, listVerb, patchVerb, updateVerb, watchVerb}
Create := []string{createVerb}
rules = append(rules, NewPolicyRule(EmptyApiGroups, "pods/portforward", Create))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "pods", Default))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "pods/exec", Default))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "configmaps", ReadOnly))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "pods/log", ReadOnly))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "secrets", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(OpenshiftApiGroup, "imagestreams", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(BuildApiGroup, "buildconfigs", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(BuildApiGroup, "builds", ReadOnly))
return rules
}
// NewPolicyRule returns a policyRule allowing verbs on resources
func NewPolicyRule(apiGroup string, resource string, verbs []string) v1.PolicyRule {
rule := v1.PolicyRule{
APIGroups: []string{apiGroup},
Resources: []string{resource},
Verbs: verbs,
}
return rule
}
// NewPolicyRule returns a policyRule allowing verbs on resources
func NewOpenShiftPolicyRule(apiGroup string, resource string, verbs []string) v1.PolicyRule {
return NewPolicyRule(apiGroup,resource,verbs)
}