Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove service account/role binding/role permissions from Fission services (#2655)

Browse Source 
* Remove cluster role references
* Convert secret/package getter cluster roles to role
* Remove all cluster role binding permissions
* Remove unwanted permission
* Try removing all RBAC-related code
* Remove additional constants
* Add functionality for service account checks
* Restrict permission across services
* Remove package informer factory from the executor
* Revert service account check code for now
* Skip adding roles in place of cluster roles
* Remove additional permission from the router

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
This commit is contained in:
Sanket Sudake
2022-12-08 16:15:19 +05:30
committed by GitHub
parent 94eead8697
commit 300739c031
18 changed files with 31 additions and 1015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/fission-all/templates/_fission-kubernetes-roles.tpl
+24 -169
View File
@@ -3,10 +3,8 @@ rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- services
- serviceaccounts
verbs:
- create
- delete
@@ -30,24 +28,6 @@ rules:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
{{- end }}
{{- define "canaryconfig-kuberules" }}
rules:
@@ -57,20 +37,6 @@ rules:
- services
verbs:
- list
- apiGroups:
- ""
resources:
- configmaps
- secrets
verbs:
- get
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- create
- apiGroups:
- ""
resources:
@@ -109,7 +75,6 @@ rules:
- namespaces
verbs:
- get
- create
- apiGroups:
- ""
resources:
@@ -132,11 +97,8 @@ rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- events
verbs:
@@ -146,6 +108,15 @@ rules:
- list
- watch
- patch
- apiGroups:
- ""
resources:
- configmaps
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
@@ -180,24 +151,6 @@ rules:
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
- apiGroups:
- metrics.k8s.io
resources:
@@ -226,16 +179,12 @@ rules:
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- batch
resources:
@@ -252,24 +201,6 @@ rules:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
{{- end }}
{{- define "kafka-kuberules" }}
rules:
@@ -280,7 +211,6 @@ rules:
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- events
verbs:
@@ -290,6 +220,13 @@ rules:
- list
- watch
- patch
- apiGroups:
- ""
resources:
- configmaps
- secrets
verbs:
- get
- apiGroups:
- apps
resources:
@@ -312,35 +249,14 @@ rules:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
{{- end }}
{{- define "keda-kuberules" }}
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- events
verbs:
@@ -350,6 +266,13 @@ rules:
- list
- watch
- patch
- apiGroups:
- ""
resources:
- configmaps
- secrets
verbs:
- get
- apiGroups:
- apps
resources:
@@ -372,24 +295,6 @@ rules:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
- apiGroups:
- keda.sh
resources:
@@ -440,23 +345,6 @@ rules: []
{{- end }}
{{- define "router-kuberules" }}
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- services
- serviceaccounts
- replicationcontrollers
- events
verbs:
- create
- delete
- get
- list
- watch
- patch
- apiGroups:
- networking.k8s.io
resources:
@@ -477,40 +365,7 @@ rules:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- bind
{{- end }}
{{- define "timer-kuberules" }}
rules:
- apiGroups:
- fission.io
resources:
- environments
- functions
- packages
- timetriggers
verbs:
- create
- get
- list
- watch
- update
- patch
- delete
rules: []
{{- end }}
charts/fission-all/templates/_function-access-role.tpl
+2 -2
View File
@@ -24,7 +24,7 @@ rules:
resources:
- packages
verbs:
- "get"
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
@@ -37,7 +37,7 @@ rules:
resources:
- packages
verbs:
- "get"
- get
- apiGroups:
- ""
resources:
charts/fission-all/templates/misc-functions/clusterrole.yaml
-33
View File
@@ -1,33 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-secret-configmap-getter
rules:
- apiGroups:
- ""
resources:
- secrets
- configmaps
verbs:
- get
- watch
- list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Release.Name }}-package-getter
rules:
- apiGroups:
- fission.io
resources:
- packages
verbs:
- "*"
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- "*"