Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add K8up viewer and editor roles to default built-in roles #289

Merged
merged 2 commits into from
Jan 15, 2021
Merged

Conversation

ccremer
Copy link
Contributor

@ccremer ccremer commented Jan 13, 2021

Summary

As described in https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles, those will be added automatically, so that any "viewer" or "editor" can view/edit K8up resources also.

Closes #284

Checklist

  • Keep pull requests small so they can be easily reviewed.
  • Categorize the PR by setting a good title and adding one of the labels:
    bug, enhancement, documentation, change, breaking,
    as they show up in the changelog
  • Link this PR to related issues.

@ccremer ccremer added the change Generic change that is neither a fix or feature label Jan 13, 2021
@ccremer ccremer requested a review from cimnine January 13, 2021 15:42
As described in https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles,
those will be added automatically, so that any "viewer" or "editor" can view/edit K8up
resources also.
@ccremer
Copy link
Contributor Author

ccremer commented Jan 13, 2021

This creates a bunch of clusterroles:

$ k get clusterrole | grep k8up
k8up-archive-editor-role                                               2m3s
k8up-archive-viewer-role                                               2m3s
k8up-backup-editor-role                                                2m3s
k8up-backup-viewer-role                                                2m3s
k8up-check-editor-role                                                 2m3s
k8up-check-viewer-role                                                 2m3s
k8up-manager-role                                                      15m
k8up-prebackuppod-editor-role                                          2m3s
k8up-prebackuppod-viewer-role                                          2m3s
k8up-prune-editor-role                                                 2m3s
k8up-prune-viewer-role                                                 2m3s
k8up-restore-editor-role                                               2m3s
k8up-restore-viewer-role                                               2m3s
k8up-schedule-editor-role                                              2m3s
k8up-schedule-viewer-role                                              2m3s
k8up-snapshot-editor-role                                              2m3s
k8up-snapshot-viewer-role                                              2m3s

I'm starting to think that a consolidated viewer and editor role makes more sense than having individual cluster roles.

@ccremer ccremer added this to the v1.0.0-rc4 milestone Jan 13, 2021
Copy link
Contributor

@cimnine cimnine left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not quite certain I've fully understood the aggregated roles, so I can say little to that other than lgtm.

Makefile Outdated Show resolved Hide resolved
It's not worth having all these roles granular
@ccremer
Copy link
Contributor Author

ccremer commented Jan 15, 2021

I'm not quite certain I've fully understood the aggregated roles, so I can say little to that other than lgtm.

It basically means that any user can view or edit K8up resources without having to create explicit rolebindings for that. Provided they have the built-in-kubernetes-default view or edit roles resp.

@ccremer ccremer merged commit 42d8652 into master Jan 15, 2021
@ccremer ccremer deleted the rbac branch January 15, 2021 10:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
change Generic change that is neither a fix or feature
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Viewer and Editor roles are disabled
2 participants