Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure controller manager and scheduler can perform delegated auth checks #72491

Merged
merged 1 commit into from
Feb 8, 2019
Merged

Ensure controller manager and scheduler can perform delegated auth checks #72491

merged 1 commit into from
Feb 8, 2019

Conversation

liggitt
Copy link
Member

@liggitt liggitt commented Jan 2, 2019

What type of PR is this?
/kind bug

What this PR does / why we need it:

  • Includes permissions required to perform delegated authn/authz checks in controller manager and scheduler roles
  • Grants permissions required to read cluster authentication configuration to controller manager and scheduler

Which issue(s) this PR fixes:
Fixes #71752

Does this PR introduce a user-facing change?:

`system:kube-controller-manager` and `system:kube-scheduler` users are now permitted to perform delegated authentication/authorization checks by default RBAC policy

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 2, 2019
@liggitt liggitt requested a review from deads2k January 2, 2019 18:34
@k8s-ci-robot k8s-ci-robot added needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jan 2, 2019
@liggitt liggitt requested a review from sttts January 2, 2019 18:34
@liggitt
Copy link
Member Author

liggitt commented Jan 2, 2019

/sig auth

@k8s-ci-robot k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jan 2, 2019
@liggitt
Copy link
Member Author

liggitt commented Jan 2, 2019

/priority important-soon

@k8s-ci-robot k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jan 2, 2019
@liggitt liggitt mentioned this pull request Jan 2, 2019
Closed
@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 2, 2019
@sttts
Copy link
Contributor

sttts commented Feb 7, 2019

Can these go?

kubernetes/test/integration/serving/serving_test.go

Line 115 in 1588af4

_, err = client.RbacV1().ClusterRoleBindings().Create(&rbacv1.ClusterRoleBinding{

@sttts
Copy link
Contributor

sttts commented Feb 7, 2019

Looks good, just some nit.

@k8s-ci-robot k8s-ci-robot added the sig/testing Categorizes an issue or PR as relevant to SIG Testing. label Feb 7, 2019
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@liggitt
Copy link
Member Author

liggitt commented Feb 7, 2019

Can these go?

yup, switched that to use the standard controller manager username and removed all custom bindings from the test

@sttts
Copy link
Contributor

sttts commented Feb 7, 2019

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 7, 2019
@liggitt liggitt mentioned this pull request Feb 7, 2019
Closed
@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

6 similar comments
@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 8, 2019
@sttts
Copy link
Contributor

sttts commented Feb 8, 2019

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 8, 2019
@k8s-ci-robot k8s-ci-robot merged commit 834c9a5 into kubernetes:master Feb 8, 2019
@liggitt liggitt deleted the delegated-auth-permissions branch February 12, 2019 18:45
@lbogdan lbogdan mentioned this pull request Feb 27, 2019
Closed
rfranzke added a commit to gardener/gardener that referenced this pull request Mar 20, 2019
@rfranzke
Don't create auth deleg. RBAC roles for controller/scheduler with 1.14
7bd507e 
See kubernetes/kubernetes#72491
rfranzke added a commit to gardener/gardener that referenced this pull request Mar 26, 2019
@rfranzke
Don't create auth deleg. RBAC roles for controller/scheduler with 1.14
cdf2815 
See kubernetes/kubernetes#72491
@neolit123 neolit123 mentioned this pull request Aug 3, 2019
Merged
@Huang-Wei Huang-Wei mentioned this pull request Nov 5, 2021
Closed
@mateoflorido mateoflorido mentioned this pull request Feb 5, 2024
Merged
@jiayiwang7 jiayiwang7 mentioned this pull request Mar 20, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sttts sttts sttts left review comments

@deads2k deads2k Awaiting requested review from deads2k

@krousey krousey Awaiting requested review from krousey

@wojtek-t wojtek-t Awaiting requested review from wojtek-t

Assignees

@sttts sttts

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

kube-scheduler is missing permissions for delegated authentication
4 participants
@liggitt @sttts @k8s-ci-robot @fejta-bot