Narrow down RBAC rules #2091
Narrow down RBAC rules #2091
Conversation
This reverts commit 16e6fe4.
|
/hold for review |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: johnugeorge The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
There was a problem hiding this comment.
@johnugeorge Thanks for this!
I confirmed this RBAC on my local using the following operation:
- create and delete random.yaml by kubectl and UI.
- create and delete from-volume-resume.yaml by kubectl and UI.
That works well.
Also, maybe we want to generate RBAC manifests by sigs.k8s.io/controller-tools/cmd/controller-gen in the future.
Note: Currently, cert-generator requires full access to secrets and UI needs full access to configmaps. Can we reduce it in the future?
I guess the cert-generator has limited access to secrets, now.
katib/manifests/v1beta1/components/cert-generator/rbac.yaml
Lines 12 to 15 in 0749265
/lgtm
Fixed configmaps and secrets as well |
|
/assign @andreyvelich @tenzen-y |
|
I have confirmed new changes using the same way as #2091 (review), again. /lgtm |
|
Thank you for this @johnugeorge! |
| - services | ||
| - events | ||
| - namespaces | ||
| verbs: | ||
| - "*" |
There was a problem hiding this comment.
Do we need * for services ?
There was a problem hiding this comment.
There was a problem hiding this comment.
We do get/create/delete/watch
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - namespaces |
There was a problem hiding this comment.
Do we need permission for namespace in the Controller @johnugeorge @tenzen-y ?
There was a problem hiding this comment.
As I can see, we operate namespaces only from UI. So we can remove the permission for namespaces.
There was a problem hiding this comment.
Yes. It is needed only in UI.
There was a problem hiding this comment.
I retested it. Currently, Katib needs get/list/watch for namespaces as well. Need to investigate separately
| - "get" | ||
| - "create" | ||
| - "list" | ||
| - "watch" | ||
| - apiGroups: | ||
| - batch | ||
| resources: |
There was a problem hiding this comment.
@johnugeorge Should we limit scope for deployment, batch, and kubeflow.org jobs ?
There was a problem hiding this comment.
we do get/create/delete/watch for all
|
/lgtm |
|
/hold cancel |
|
/lgtm |
This PR narrows down the RBAC rules for Katib controller installation
Fixes: #1639