TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-01-07 08:07:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/k8s-operator/deploy: replace wildcards in Kubernetes Operator RBAC role definitions with verbs

Browse Source 
cmd/k8s-operator/deploy: replace wildcards in Kubernetes Operator RBAC role definitions with verbs

fixes: #13168

Signed-off-by: Pierig Le Saux <pierig@n3xt.io>
This commit is contained in:
pierig-n3xtio 2024-08-20 09:44:50 -04:00 committed by GitHub
parent 01aa01f310
commit 2105773874
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 45 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/k8s-operator/deploy/chart/templates/operator-rbac.yaml
View File

@ -14,10 +14,10 @@ metadata:
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["events", "services", "services/status"] resources: ["events", "services", "services/status"]
verbs: ["*"] verbs: ["create","delete","deletecollection","get","list","patch","update","watch"]
- apiGroups: ["networking.k8s.io"] - apiGroups: ["networking.k8s.io"]
resources: ["ingresses", "ingresses/status"] resources: ["ingresses", "ingresses/status"]
verbs: ["*"] verbs: ["create","delete","deletecollection","get","list","patch","update","watch"]
- apiGroups: ["networking.k8s.io"] - apiGroups: ["networking.k8s.io"]
resources: ["ingressclasses"] resources: ["ingressclasses"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
@ -49,10 +49,10 @@ metadata:
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["secrets", "serviceaccounts", "configmaps"] resources: ["secrets", "serviceaccounts", "configmaps"]
verbs: ["*"] verbs: ["create","delete","deletecollection","get","list","patch","update","watch"]
- apiGroups: ["apps"] - apiGroups: ["apps"]
resources: ["statefulsets", "deployments"] resources: ["statefulsets", "deployments"]
verbs: ["*"] verbs: ["create","delete","deletecollection","get","list","patch","update","watch"]
- apiGroups: ["discovery.k8s.io"] - apiGroups: ["discovery.k8s.io"]
resources: ["endpointslices"] resources: ["endpointslices"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]

2
cmd/k8s-operator/deploy/chart/templates/proxy-rbac.yaml
View File

@ -15,7 +15,7 @@ metadata:
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["secrets"] resources: ["secrets"]
verbs: ["*"] verbs: ["create","delete","deletecollection","get","list","patch","update","watch"]
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding kind: RoleBinding

45
cmd/k8s-operator/deploy/manifests/operator.yaml
View File

@ -2428,14 +2428,28 @@ rules:
- services - services
- services/status - services/status
verbs: verbs:
- '*' - create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups: - apiGroups:
- networking.k8s.io - networking.k8s.io
resources: resources:
- ingresses - ingresses
- ingresses/status - ingresses/status
verbs: verbs:
- '*' - create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups: - apiGroups:
- networking.k8s.io - networking.k8s.io
resources: resources:
@ -2493,14 +2507,28 @@ rules:
- serviceaccounts - serviceaccounts
- configmaps - configmaps
verbs: verbs:
- '*' - create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups: - apiGroups:
- apps - apps
resources: resources:
- statefulsets - statefulsets
- deployments - deployments
verbs: verbs:
- '*' - create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups: - apiGroups:
- discovery.k8s.io - discovery.k8s.io
resources: resources:
@ -2521,7 +2549,14 @@ rules:
resources: resources:
- secrets - secrets
verbs: verbs:
- '*' - create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding kind: RoleBinding