From 5d0d04d69ead4cd4db772d40f48d6f937b818b65 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Fri, 15 Nov 2019 20:37:43 -0500 Subject: [PATCH] Add single-item list/watch to delegated authentication reader role --- .../auth/authorizer/rbac/bootstrappolicy/namespace_policy.go | 2 +- .../rbac/bootstrappolicy/testdata/namespace-roles.yaml | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/namespace_policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/namespace_policy.go index b2983c44e452..1fbacefa24a6 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/namespace_policy.go +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/namespace_policy.go @@ -77,7 +77,7 @@ func init() { ObjectMeta: metav1.ObjectMeta{Name: "extension-apiserver-authentication-reader"}, Rules: []rbacv1.PolicyRule{ // this particular config map is exposed and contains authentication configuration information - rbacv1helpers.NewRule("get").Groups(legacyGroup).Resources("configmaps").Names("extension-apiserver-authentication").RuleOrDie(), + rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("configmaps").Names("extension-apiserver-authentication").RuleOrDie(), }, }) addNamespaceRole(metav1.NamespaceSystem, rbacv1.Role{ diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-roles.yaml b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-roles.yaml index efcc4bdbe192..a15ac9613d35 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-roles.yaml +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/namespace-roles.yaml @@ -54,6 +54,8 @@ items: - configmaps verbs: - get + - list + - watch - apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: