-
Notifications
You must be signed in to change notification settings - Fork 103
/
rbac.go
66 lines (57 loc) · 1.86 KB
/
rbac.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
// Unless explicitly stated otherwise all files in this repository are licensed
// under the Apache License Version 2.0.
// This product includes software developed at Datadog (https://www.datadoghq.com/).
// Copyright 2016-present Datadog, Inc.
package agent
import (
"fmt"
apicommon "github.com/DataDog/datadog-operator/apis/datadoghq/common"
"github.com/DataDog/datadog-operator/pkg/kubernetes/rbac"
rbacv1 "k8s.io/api/rbac/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
// GetAgentRoleName returns the name of the role for the Agent
func GetAgentRoleName(dda metav1.Object) string {
return fmt.Sprintf("%s-%s", dda.GetName(), apicommon.DefaultAgentResourceSuffix)
}
// GetDefaultAgentClusterRolePolicyRules returns the default policy rules for the Agent cluster role
func GetDefaultAgentClusterRolePolicyRules() []rbacv1.PolicyRule {
return []rbacv1.PolicyRule{
getMetricsEndpointPolicyRule(),
getKubeletPolicyRule(),
getEndpointsPolicyRule(),
getLeaderElectionPolicyRule(),
}
}
func getMetricsEndpointPolicyRule() rbacv1.PolicyRule {
return rbacv1.PolicyRule{
NonResourceURLs: []string{rbac.MetricsURL},
Verbs: []string{rbac.GetVerb},
}
}
func getKubeletPolicyRule() rbacv1.PolicyRule {
return rbacv1.PolicyRule{
APIGroups: []string{rbac.CoreAPIGroup},
Resources: []string{
rbac.NodeMetricsResource,
rbac.NodeSpecResource,
rbac.NodeProxyResource,
rbac.NodeStats,
},
Verbs: []string{rbac.GetVerb},
}
}
func getEndpointsPolicyRule() rbacv1.PolicyRule {
return rbacv1.PolicyRule{
APIGroups: []string{rbac.CoreAPIGroup},
Resources: []string{rbac.EndpointsResource},
Verbs: []string{rbac.GetVerb},
}
}
func getLeaderElectionPolicyRule() rbacv1.PolicyRule {
return rbacv1.PolicyRule{
APIGroups: []string{rbac.CoordinationAPIGroup},
Resources: []string{rbac.LeasesResource},
Verbs: []string{rbac.GetVerb},
}
}