ClusterRole Aggregation #502

deads2k · 2017-10-27T17:40:52Z

Feature Description

Add a way for API extenders to add permissions to existing roles
Primary contact (assignee): @deads2k
Responsible SIGs: @kubernetes/sig-auth-feature-requests
Design proposal link (community repo): add clusterrole aggregation doc community#1219
Reviewer(s) - @liggitt @ericchiang
Approver (likely from SIG/area to which feature belongs): @liggitt
Feature target (which target equals to which milestone):
- Beta release target (x.y): 1.9
- Stable release target (x.y): 1.11

Automatic merge from submit-queue (batch tested with PRs 54005, 55127, 53850, 55486, 53440). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. aggregate cluster roles xref kubernetes/community#1219 kubernetes/enhancements#502 This is a pull with API types, a controller, and a demonstration of how to move admin, edit, and view. Once we agree on the shape, I'll I added ```yaml aggregationRule: clusterRoleSelectors: - matchLabels: rbac.authorization.k8s.io/aggregate-to-admin: true ``` to the `ClusterRole`. A controller then goes and gathers all the matching ClusterRoles and sets the `rules` to the union of matching cluster roles. @kubernetes/sig-auth-pr-reviews ```release-note RBAC ClusterRoles can now select other roles to aggregate ```

Automatic merge from submit-queue (batch tested with PRs 54005, 55127, 53850, 55486, 53440). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. aggregate cluster roles xref kubernetes/community#1219 kubernetes/enhancements#502 This is a pull with API types, a controller, and a demonstration of how to move admin, edit, and view. Once we agree on the shape, I'll I added ```yaml aggregationRule: clusterRoleSelectors: - matchLabels: rbac.authorization.k8s.io/aggregate-to-admin: true ``` to the `ClusterRole`. A controller then goes and gathers all the matching ClusterRoles and sets the `rules` to the union of matching cluster roles. @kubernetes/sig-auth-pr-reviews ```release-note RBAC ClusterRoles can now select other roles to aggregate ``` Kubernetes-commit: f575c55589db84ef4d392823120f0238fd19ad93

zacharysarah · 2017-11-22T21:30:48Z

@deads2k 👋 Please open a documentation PR and add a link to the tracking spreadsheet. Thanks in advance!

Automatic merge from submit-queue (batch tested with PRs 54005, 55127, 53850, 55486, 53440). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. aggregate cluster roles xref kubernetes/community#1219 kubernetes/enhancements#502 This is a pull with API types, a controller, and a demonstration of how to move admin, edit, and view. Once we agree on the shape, I'll I added ```yaml aggregationRule: clusterRoleSelectors: - matchLabels: rbac.authorization.k8s.io/aggregate-to-admin: true ``` to the `ClusterRole`. A controller then goes and gathers all the matching ClusterRoles and sets the `rules` to the union of matching cluster roles. @kubernetes/sig-auth-pr-reviews ```release-note RBAC ClusterRoles can now select other roles to aggregate ``` Kubernetes-commit: f575c55589db84ef4d392823120f0238fd19ad93

lookuptable · 2017-11-28T22:25:02Z

@deads2k Is there a plan to add E2E tests for this feature?

Automatic merge from submit-queue (batch tested with PRs 54005, 55127, 53850, 55486, 53440). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. aggregate cluster roles xref kubernetes/community#1219 kubernetes/enhancements#502 This is a pull with API types, a controller, and a demonstration of how to move admin, edit, and view. Once we agree on the shape, I'll I added ```yaml aggregationRule: clusterRoleSelectors: - matchLabels: rbac.authorization.k8s.io/aggregate-to-admin: true ``` to the `ClusterRole`. A controller then goes and gathers all the matching ClusterRoles and sets the `rules` to the union of matching cluster roles. @kubernetes/sig-auth-pr-reviews ```release-note RBAC ClusterRoles can now select other roles to aggregate ``` Kubernetes-commit: f575c55589db84ef4d392823120f0238fd19ad93

zacharysarah · 2017-11-28T23:54:07Z

@deads2k Bump for docs ☝️

/cc @idvoretskyi

ericchiang · 2017-11-29T00:14:38Z

I can open a docs PR. cc @deads2k

Automatic merge from submit-queue (batch tested with PRs 54005, 55127, 53850, 55486, 53440). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. aggregate cluster roles xref kubernetes/community#1219 kubernetes/enhancements#502 This is a pull with API types, a controller, and a demonstration of how to move admin, edit, and view. Once we agree on the shape, I'll I added ```yaml aggregationRule: clusterRoleSelectors: - matchLabels: rbac.authorization.k8s.io/aggregate-to-admin: true ``` to the `ClusterRole`. A controller then goes and gathers all the matching ClusterRoles and sets the `rules` to the union of matching cluster roles. @kubernetes/sig-auth-pr-reviews ```release-note RBAC ClusterRoles can now select other roles to aggregate ``` Kubernetes-commit: f575c55589db84ef4d392823120f0238fd19ad93

deads2k · 2017-11-29T15:36:47Z

I can open a docs PR. cc @deads2k

Thanks. I forgot that I gave detail usage in the community pull and didn't open the corresponding website one.

@deads2k Is there a plan to add E2E tests for this feature?

We use this feature to bootstrap the cluster, so it is tested in every e2e run already.

Automatic merge from submit-queue (batch tested with PRs 54005, 55127, 53850, 55486, 53440). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. aggregate cluster roles xref kubernetes/community#1219 kubernetes/enhancements#502 This is a pull with API types, a controller, and a demonstration of how to move admin, edit, and view. Once we agree on the shape, I'll I added ```yaml aggregationRule: clusterRoleSelectors: - matchLabels: rbac.authorization.k8s.io/aggregate-to-admin: true ``` to the `ClusterRole`. A controller then goes and gathers all the matching ClusterRoles and sets the `rules` to the union of matching cluster roles. @kubernetes/sig-auth-pr-reviews ```release-note RBAC ClusterRoles can now select other roles to aggregate ``` Kubernetes-commit: f575c55589db84ef4d392823120f0238fd19ad93

fejta-bot · 2018-02-27T16:21:50Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot · 2018-03-29T17:08:53Z

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

justaugustus · 2018-04-17T03:28:17Z

@ericchiang @deads2k
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

Description
Milestone
Assignee(s)
Labels:
- stage/{alpha,beta,stable}
- sig/*
- kind/feature

cc @idvoretskyi

deads2k · 2018-04-17T11:57:35Z

The feature has been remarkably stable. I'm ok promoting it as-is.

@kubernetes/sig-auth-api-reviews opinions?

enj · 2018-04-17T13:01:19Z

IIRC all the bugs we saw were obvious (cluster failed to start) or wiring issues (incorrect upgrade). I do not think we had any issues in the actual controller that backs this feature. I am also unaware of any changes we need to make to the API. Thus I agree with @deads2k.

/remove-lifecycle rotten

justaugustus · 2018-04-17T20:47:52Z

Updated the milestone. Thanks for the feedback, @deads2k + @enj!

AishSundar · 2018-05-23T21:39:28Z

@deads2k I saw your earlier reply about e2e tests for this feature. I am following up to see if and which of those tests should we promoted to the conformance test suite. Let me know if we already have coverage for this feature in Conformance suite

As part of the process to increase conformance coverage, outlined by Conformance WG and Sig-Arch, we expect features going into stable/GA to have representation in Conformance suite. So your update on the same will help us evaluate this feature better.

liggitt · 2018-05-23T21:43:45Z

Let me know if we already have coverage for this feature in Conformance suite

RBAC is not required for a cluster to be conformant, so no conformance tests require it. See discussion in kubernetes/kubernetes#62988

AishSundar · 2018-05-23T21:59:06Z

Thanks for the quick followup @liggitt

mdlinville · 2018-05-24T23:38:27Z

@deads2k please fill out the appropriate line item of the
1.11 feature tracking spreadsheet
and open a placeholder docs PR against the
release-1.11 branch
by 5/25/2018 (tomorrow as I write this) if new docs or docs changes are
needed and a relevant PR has not yet been opened.

justaugustus · 2018-06-27T22:14:55Z

Closing this as the feature is GA in 1.11. Please feel free to reopen if there is still a need to track this.
/close

deads2k assigned liggitt, ericchiang and deads2k Oct 27, 2017

k8s-ci-robot added sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. kind/feature Categorizes issue or PR as related to a new feature. labels Oct 27, 2017

deads2k mentioned this issue Nov 10, 2017

aggregate cluster roles kubernetes/kubernetes#54005

Merged

liggitt added sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. labels Nov 11, 2017

liggitt added this to the v1.9 milestone Nov 13, 2017

liggitt added the stage/beta Denotes an issue tracking an enhancement targeted for Beta status label Nov 13, 2017

zacharysarah added the do-not-merge/docs label Nov 28, 2017

ericchiang mentioned this issue Nov 29, 2017

rbac: docs for aggregated cluster roles kubernetes/website#6474

Merged

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 27, 2018

k8s-ci-robot added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Mar 29, 2018

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 29, 2018

k8s-ci-robot added the kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API label Apr 17, 2018

k8s-ci-robot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Apr 17, 2018

justaugustus modified the milestones: v1.9, v1.11 Apr 17, 2018

justaugustus added stage/stable Denotes an issue tracking an enhancement targeted for Stable/GA status tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team and removed stage/beta Denotes an issue tracking an enhancement targeted for Beta status labels Apr 29, 2018

k8s-ci-robot assigned justaugustus Jun 27, 2018

k8s-ci-robot closed this as completed Jun 27, 2018

kacole2 removed tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team labels Oct 15, 2018

flavio-fernandes mentioned this issue Apr 25, 2023

[release-4.14] OCPBUGS-11550: AUTH: update cluster-reader to include k8s.ovn.org openshift/cluster-network-operator#1791

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ClusterRole Aggregation #502

ClusterRole Aggregation #502

deads2k commented Oct 27, 2017 •

edited by justaugustus

Loading

zacharysarah commented Nov 22, 2017

lookuptable commented Nov 28, 2017

zacharysarah commented Nov 28, 2017

ericchiang commented Nov 29, 2017

deads2k commented Nov 29, 2017

fejta-bot commented Feb 27, 2018

fejta-bot commented Mar 29, 2018

justaugustus commented Apr 17, 2018

deads2k commented Apr 17, 2018

enj commented Apr 17, 2018

justaugustus commented Apr 17, 2018

AishSundar commented May 23, 2018

liggitt commented May 23, 2018

AishSundar commented May 23, 2018

mdlinville commented May 24, 2018

justaugustus commented Jun 27, 2018

ClusterRole Aggregation #502

ClusterRole Aggregation #502

Comments

deads2k commented Oct 27, 2017 • edited by justaugustus Loading

Feature Description

zacharysarah commented Nov 22, 2017

lookuptable commented Nov 28, 2017

zacharysarah commented Nov 28, 2017

ericchiang commented Nov 29, 2017

deads2k commented Nov 29, 2017

fejta-bot commented Feb 27, 2018

fejta-bot commented Mar 29, 2018

justaugustus commented Apr 17, 2018

deads2k commented Apr 17, 2018

enj commented Apr 17, 2018

justaugustus commented Apr 17, 2018

AishSundar commented May 23, 2018

liggitt commented May 23, 2018

AishSundar commented May 23, 2018

mdlinville commented May 24, 2018

justaugustus commented Jun 27, 2018

deads2k commented Oct 27, 2017 •

edited by justaugustus

Loading