Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix local up cluster dns with RBAC #38403

Merged
merged 2 commits into from
Dec 9, 2016
Merged

Fix local up cluster dns with RBAC #38403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b18e433
add serviceaccount option to clusterrrolebinding
deads2k Dec 8, 2016
207c04a
update dns start to grant required RBAC permissions
deads2k Dec 8, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
24 changes: 14 additions & 10 deletions hack/local-up-cluster.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,6 +400,14 @@ contexts:
user: local-up-cluster
name: local-up-cluster
current-context: local-up-cluster
EOF

# flatten the kubeconfig files to make them self contained
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no need for the temporary file. Just pipe the HERE document above through kubectl config view --kubeconfig /dev/stdin --minify --flatten

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no need for the temporary file. Just pipe the HERE document above through kubectl config view --kubeconfig /dev/stdin --minify --flatten

I tried here: https://gist.github.com/deads2k/18d7d352671fbb50d2c362a326eae489, but the kubeconfigs were always empty.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

leave it as it is for now. Will take a look later.

username=$(whoami)
${CONTROLPLANE_SUDO} /bin/bash -e <<EOF
${GO_OUT}/kubectl --kubeconfig="${CERT_DIR}/$1.kubeconfig" config view --minify --flatten > "/tmp/$1.kubeconfig"
mv -f "/tmp/$1.kubeconfig" "${CERT_DIR}/$1.kubeconfig"
chown ${username} "${CERT_DIR}/$1.kubeconfig"
EOF
}

Expand Down Expand Up @@ -724,7 +732,6 @@ function start_kubeproxy {
}

function start_kubedns {

if [[ "${ENABLE_CLUSTER_DNS}" = true ]]; then
echo "Creating kube-system namespace"
sed -e "s/{{ pillar\['dns_replicas'\] }}/${DNS_REPLICAS}/g;s/{{ pillar\['dns_domain'\] }}/${DNS_DOMAIN}/g;" "${KUBE_ROOT}/cluster/addons/dns/skydns-rc.yaml.in" >| skydns-rc.yaml
Expand All @@ -742,18 +749,15 @@ function start_kubedns {
sed -i -e "/{{ pillar\['federations_domain_map'\] }}/d" skydns-rc.yaml
fi
sed -e "s/{{ pillar\['dns_server'\] }}/${DNS_SERVER_IP}/g" "${KUBE_ROOT}/cluster/addons/dns/skydns-svc.yaml.in" >| skydns-svc.yaml
export KUBERNETES_PROVIDER=local
${KUBECTL} config set-cluster local --server=https://${API_HOST}:${API_SECURE_PORT} --certificate-authority=${ROOT_CA_FILE}
${KUBECTL} config set-credentials myself --username=admin --password=admin
${KUBECTL} config set-context local --cluster=local --user=myself
${KUBECTL} config use-context local


# TODO update to dns role once we have one.
${KUBECTL} --kubeconfig="${CERT_DIR}/admin.kubeconfig" create clusterrolebinding system:kube-dns --clusterrole=cluster-admin --serviceaccount=kube-system:default
# use kubectl to create skydns rc and service
${KUBECTL} --namespace=kube-system create -f skydns-rc.yaml
${KUBECTL} --namespace=kube-system create -f skydns-svc.yaml
${KUBECTL} --kubeconfig="${CERT_DIR}/admin.kubeconfig" --namespace=kube-system create -f skydns-rc.yaml
${KUBECTL} --kubeconfig="${CERT_DIR}/admin.kubeconfig" --namespace=kube-system create -f skydns-svc.yaml
echo "Kube-dns rc and service successfully deployed."
rm skydns-rc.yaml skydns-svc.yaml
fi

}

function print_success {
Expand Down
26 changes: 22 additions & 4 deletions pkg/kubectl/clusterrolebinding.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ package kubectl
import (
"fmt"

"strings"

"k8s.io/kubernetes/pkg/apis/rbac"
"k8s.io/kubernetes/pkg/runtime"
)
Expand All @@ -33,6 +35,8 @@ type ClusterRoleBindingGeneratorV1 struct {
Users []string
// Groups to derive the clusterRoleBinding from (optional)
Groups []string
// ServiceAccounts to derive the clusterRoleBinding from in namespace:name format(optional)
ServiceAccounts []string
}

// Ensure it supports the generator pattern that uses parameter injection.
Expand Down Expand Up @@ -66,6 +70,15 @@ func (s ClusterRoleBindingGeneratorV1) Generate(genericParams map[string]interfa
delegate.Groups = fromLiteralArray
delete(genericParams, "group")
}
fromSAStrings, found := genericParams["serviceaccount"]
if found {
fromLiteralArray, isArray := fromSAStrings.([]string)
if !isArray {
return nil, fmt.Errorf("expected []string, found :%v", fromFileStrings)
}
delegate.ServiceAccounts = fromLiteralArray
delete(genericParams, "serviceaccounts")
}
params := map[string]string{}
for key, value := range genericParams {
strVal, isString := value.(string)
Expand All @@ -86,6 +99,7 @@ func (s ClusterRoleBindingGeneratorV1) ParamNames() []GeneratorParam {
{"clusterrole", false},
{"user", false},
{"group", false},
{"serviceaccount", false},
{"force", false},
}
}
Expand All @@ -109,11 +123,15 @@ func (s ClusterRoleBindingGeneratorV1) StructuredGenerate() (runtime.Object, err
Name: user,
})
}
for _, group := range s.Groups {
for _, sa := range s.ServiceAccounts {
tokens := strings.Split(sa, ":")
if len(tokens) != 2 {
return nil, fmt.Errorf("serviceaccount must be <namespace>:<name>")
}
clusterRoleBinding.Subjects = append(clusterRoleBinding.Subjects, rbac.Subject{
Kind: rbac.GroupKind,
APIVersion: "rbac/v1alpha1",
Name: group,
Kind: rbac.ServiceAccountKind,
Namespace: tokens[0],
Name: tokens[1],
})
}

Expand Down
10 changes: 6 additions & 4 deletions pkg/kubectl/cmd/create_clusterrolebinding.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ func NewCmdCreateClusterRoleBinding(f cmdutil.Factory, cmdOut io.Writer) *cobra.
cmd.Flags().String("clusterrole", "", "ClusterRole this ClusterRoleBinding should reference")
cmd.Flags().StringSlice("user", []string{}, "usernames to bind to the role")
cmd.Flags().StringSlice("group", []string{}, "groups to bind to the role")
cmd.Flags().StringSlice("serviceaccount", []string{}, "service accounts to bind to the role")
return cmd
}

Expand All @@ -68,10 +69,11 @@ func CreateClusterRoleBinding(f cmdutil.Factory, cmdOut io.Writer, cmd *cobra.Co
switch generatorName := cmdutil.GetFlagString(cmd, "generator"); generatorName {
case cmdutil.ClusterRoleBindingV1GeneratorName:
generator = &kubectl.ClusterRoleBindingGeneratorV1{
Name: name,
ClusterRole: cmdutil.GetFlagString(cmd, "clusterrole"),
Users: cmdutil.GetFlagStringSlice(cmd, "user"),
Groups: cmdutil.GetFlagStringSlice(cmd, "group"),
Name: name,
ClusterRole: cmdutil.GetFlagString(cmd, "clusterrole"),
Users: cmdutil.GetFlagStringSlice(cmd, "user"),
Groups: cmdutil.GetFlagStringSlice(cmd, "group"),
ServiceAccounts: cmdutil.GetFlagStringSlice(cmd, "serviceaccount"),
}
default:
return cmdutil.UsageError(cmd, fmt.Sprintf("Generator: %s not supported.", generatorName))
Expand Down