Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Create a cluster-role for an apb the requires elevated privilages
This patch is intented to enable apbs that access resources across namespaces or creates cluster level resources to work.

To try this out you'll need a few things:
  1) The asb user needs to have cluster-admin permissions in order to give cluster-admin permission
     ```
     oc adm policy add-cluster-role-to-user cluster-admin -n ansible-service-broker -z asb
     ```
  2) The broker config must have ```auto-escalate: true``` and ```sandbox_role: cluster-admin```.
  3) Build and Deploy the broker with this patch.
     ```
     git checkout -b cluster-role-access
     git pull https://github.com/rthallisey/ansible-service-broker.git cluster-role-access
     make build-image ORG=<my-registry>
     make deploy ORG=<my-registry>
     ```
  • Loading branch information
Ryan Hallisey committed Jan 31, 2018
1 parent f1da11b commit f27e053
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 9 deletions.
4 changes: 2 additions & 2 deletions pkg/clients/kubernetes.go
Expand Up @@ -154,15 +154,15 @@ func (k KubernetesClient) CreateRoleBinding(
roleRef rbac.RoleRef) error {

log.Noticef("Creating RoleBinding %s", roleBindingName)
roleBinding := &rbac.RoleBinding{
roleBinding := &rbac.ClusterRoleBinding{
ObjectMeta: metav1.ObjectMeta{
Name: roleBindingName,
Namespace: targetNamespace,
},
Subjects: rbacSubjects,
RoleRef: roleRef,
}
_, err := k.Client.RbacV1beta1().RoleBindings(targetNamespace).Create(roleBinding)
_, err := k.Client.RbacV1beta1().ClusterRoleBindings().Create(roleBinding)
if err != nil {
return err
}
Expand Down
7 changes: 0 additions & 7 deletions pkg/runtime/runtime.go
Expand Up @@ -179,13 +179,6 @@ func (p provider) CreateSandbox(podName string,
return "", err
}

for _, target := range targets {
err = k8scli.CreateRoleBinding(podName, subjects, namespace, target, roleRef)
if err != nil {
return "", err
}
}

// Must create a Network policy to allow for comunication from the APB pod to the target namespace.
networkPolicy := &networkingv1.NetworkPolicy{
ObjectMeta: metav1.ObjectMeta{
Expand Down

0 comments on commit f27e053

Please sign in to comment.