Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: limit usage of * in RBAC #440

Draft
wants to merge 5 commits into
base: master
Choose a base branch
from
+67 −4
Draft

fix: limit usage of * in RBAC #440

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8a361e0
fix: limit usage of * in RBAC
MatousJobanek May 15, 2023
f99eca5
Merge branch 'master' into limit-permissions-member
MatousJobanek May 15, 2023
f8fbda0
comment
MatousJobanek May 16, 2023
58d1ad6
Merge branch 'master' into limit-permissions-member
mfrancisc May 16, 2023
7084d4b
Merge branch 'master' into limit-permissions-member
MatousJobanek May 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions config/rbac/appstudio_api_permissions_role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# permissions needed to apply appstudio templates.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: appstudio-api-permissions
rules:
- apiGroups:
- appstudio.redhat.com
- tekton.dev
- jvmbuildservice.io
resources:
- "*"
verbs:
# TODO fix after changing the ADR and associated appstudio teemplates
- "*"
- apiGroups:
- managed-gitops.redhat.com
- results.tekton.dev
resources:
- "*"
verbs:
- get
- list
- watch
- update
- patch
- delete
- create
- apiGroups:
- ""
resources:
- secrets
- configmaps
verbs:
# TODO fix after changing the ADR and associated appstudio teemplates
- "*"
12 changes: 12 additions & 0 deletions config/rbac/appstudio_api_permissions_rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: appstudio-api-permissions
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: appstudio-api-permissions
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
12 changes: 12 additions & 0 deletions config/rbac/edit_role_binding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: edit-manager-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: edit
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
4 changes: 4 additions & 0 deletions config/rbac/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ resources:
- service_account.yaml
- role.yaml
- role_binding.yaml
- edit_role_binding.yaml
- leader_election_role.yaml
- leader_election_role_binding.yaml
- camel_k_role.yaml
Expand All @@ -20,3 +21,6 @@ resources:
- auth_proxy_role.yaml
- auth_proxy_role_binding.yaml
- auth_proxy_client_clusterrole.yaml
# Extra permissions for AppStudio tiers
- appstudio_api_permissions_role.yaml
- appstudio_api_permissions_rolebinding.yaml
2 changes: 1 addition & 1 deletion controllers/memberstatus/memberstatus_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ type Reconciler struct {
//+kubebuilder:rbac:groups=toolchain.dev.openshift.com,resources=memberstatuses/finalizers,verbs=update

//+kubebuilder:rbac:groups="",resources=nodes,verbs=get;list;watch
//+kubebuilder:rbac:groups=metrics.k8s.io,resources=*,verbs=get;list;watch
//+kubebuilder:rbac:groups=metrics.k8s.io,resources=nodes,verbs=get;list;watch
//+kubebuilder:rbac:groups=route.openshift.io,resources=routes,verbs=get;list;watch

// Reconcile reads the state of toolchain member cluster components and updates the MemberStatus resource with information useful for observation or troubleshooting
Expand Down
5 changes: 2 additions & 3 deletions controllers/nstemplateset/nstemplateset_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,9 +89,8 @@ type Reconciler struct {
//+kubebuilder:rbac:groups=toolchain.dev.openshift.com,resources=nstemplatesets/status,verbs=get;update;patch
//+kubebuilder:rbac:groups=toolchain.dev.openshift.com,resources=nstemplatesets/finalizers,verbs=update

//+kubebuilder:rbac:groups="",resources=namespaces;limitranges,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups="",resources=namespaces;resourcequotas,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=rbac.authorization.k8s.io;authorization.openshift.io,resources=rolebindings;roles;clusterroles;clusterrolebindings,verbs=*
//+kubebuilder:rbac:groups="",resources=namespaces;limitranges;resourcequotas;pods/exec,verbs=get;list;watch;create;update;patch;delete
Copy link
Contributor

@mfrancisc mfrancisc May 16, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just trying to understand - what is this controller doing with pods/exec resources ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is needed to be able to apply sandbox templates https://github.com/codeready-toolchain/host-operator/blob/master/deploy/templates/nstemplatetiers/base1ns/ns_dev.yaml#L21-L37

//+kubebuilder:rbac:groups=rbac.authorization.k8s.io;authorization.openshift.io,resources=rolebindings;roles;clusterroles;clusterrolebindings,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=quota.openshift.io,resources=clusterresourcequotas,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=appstudio.redhat.com,resources=environments,verbs=get;list;watch;create;update;delete
Expand Down