namespace_policy.go 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163
  1. /*
  2. Copyright 2016 The Kubernetes Authors.
  3. Licensed under the Apache License, Version 2.0 (the "License");
  4. you may not use this file except in compliance with the License.
  5. You may obtain a copy of the License at
  6. http://www.apache.org/licenses/LICENSE-2.0
  7. Unless required by applicable law or agreed to in writing, software
  8. distributed under the License is distributed on an "AS IS" BASIS,
  9. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  10. See the License for the specific language governing permissions and
  11. limitations under the License.
  12. */
  13. package bootstrappolicy
  14. import (
  15. "strings"
  16. "k8s.io/klog"
  17. rbacv1 "k8s.io/api/rbac/v1"
  18. metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
  19. "k8s.io/apiserver/pkg/authentication/user"
  20. rbacv1helpers "k8s.io/kubernetes/pkg/apis/rbac/v1"
  21. )
  22. var (
  23. // namespaceRoles is a map of namespace to slice of roles to create
  24. namespaceRoles = map[string][]rbacv1.Role{}
  25. // namespaceRoleBindings is a map of namespace to slice of roleBindings to create
  26. namespaceRoleBindings = map[string][]rbacv1.RoleBinding{}
  27. )
  28. func addNamespaceRole(namespace string, role rbacv1.Role) {
  29. if !strings.HasPrefix(namespace, "kube-") {
  30. klog.Fatalf(`roles can only be bootstrapped into reserved namespaces starting with "kube-", not %q`, namespace)
  31. }
  32. existingRoles := namespaceRoles[namespace]
  33. for _, existingRole := range existingRoles {
  34. if role.Name == existingRole.Name {
  35. klog.Fatalf("role %q was already registered in %q", role.Name, namespace)
  36. }
  37. }
  38. role.Namespace = namespace
  39. addDefaultMetadata(&role)
  40. existingRoles = append(existingRoles, role)
  41. namespaceRoles[namespace] = existingRoles
  42. }
  43. func addNamespaceRoleBinding(namespace string, roleBinding rbacv1.RoleBinding) {
  44. if !strings.HasPrefix(namespace, "kube-") {
  45. klog.Fatalf(`rolebindings can only be bootstrapped into reserved namespaces starting with "kube-", not %q`, namespace)
  46. }
  47. existingRoleBindings := namespaceRoleBindings[namespace]
  48. for _, existingRoleBinding := range existingRoleBindings {
  49. if roleBinding.Name == existingRoleBinding.Name {
  50. klog.Fatalf("rolebinding %q was already registered in %q", roleBinding.Name, namespace)
  51. }
  52. }
  53. roleBinding.Namespace = namespace
  54. addDefaultMetadata(&roleBinding)
  55. existingRoleBindings = append(existingRoleBindings, roleBinding)
  56. namespaceRoleBindings[namespace] = existingRoleBindings
  57. }
  58. func init() {
  59. addNamespaceRole(metav1.NamespaceSystem, rbacv1.Role{
  60. // role for finding authentication config info for starting a server
  61. ObjectMeta: metav1.ObjectMeta{Name: "extension-apiserver-authentication-reader"},
  62. Rules: []rbacv1.PolicyRule{
  63. // this particular config map is exposed and contains authentication configuration information
  64. rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("configmaps").Names("extension-apiserver-authentication").RuleOrDie(),
  65. },
  66. })
  67. addNamespaceRole(metav1.NamespaceSystem, rbacv1.Role{
  68. // role for the bootstrap signer to be able to inspect kube-system secrets
  69. ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "bootstrap-signer"},
  70. Rules: []rbacv1.PolicyRule{
  71. rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("secrets").RuleOrDie(),
  72. },
  73. })
  74. addNamespaceRole(metav1.NamespaceSystem, rbacv1.Role{
  75. // role for the cloud providers to access/create kube-system configmaps
  76. // Deprecated starting Kubernetes 1.10 and will be deleted according to GA deprecation policy.
  77. ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "cloud-provider"},
  78. Rules: []rbacv1.PolicyRule{
  79. rbacv1helpers.NewRule("create", "get", "list", "watch").Groups(legacyGroup).Resources("configmaps").RuleOrDie(),
  80. },
  81. })
  82. addNamespaceRole(metav1.NamespaceSystem, rbacv1.Role{
  83. // role for the token-cleaner to be able to remove secrets, but only in kube-system
  84. ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "token-cleaner"},
  85. Rules: []rbacv1.PolicyRule{
  86. rbacv1helpers.NewRule("get", "list", "watch", "delete").Groups(legacyGroup).Resources("secrets").RuleOrDie(),
  87. eventsRule(),
  88. },
  89. })
  90. // TODO: Create util on Role+Binding for leader locking if more cases evolve.
  91. addNamespaceRole(metav1.NamespaceSystem, rbacv1.Role{
  92. // role for the leader locking on supplied configmap
  93. ObjectMeta: metav1.ObjectMeta{Name: "system::leader-locking-kube-controller-manager"},
  94. Rules: []rbacv1.PolicyRule{
  95. rbacv1helpers.NewRule("watch").Groups(legacyGroup).Resources("configmaps").RuleOrDie(),
  96. rbacv1helpers.NewRule("get", "update").Groups(legacyGroup).Resources("configmaps").Names("kube-controller-manager").RuleOrDie(),
  97. },
  98. })
  99. addNamespaceRole(metav1.NamespaceSystem, rbacv1.Role{
  100. // role for the leader locking on supplied configmap
  101. ObjectMeta: metav1.ObjectMeta{Name: "system::leader-locking-kube-scheduler"},
  102. Rules: []rbacv1.PolicyRule{
  103. rbacv1helpers.NewRule("watch").Groups(legacyGroup).Resources("configmaps").RuleOrDie(),
  104. rbacv1helpers.NewRule("get", "update").Groups(legacyGroup).Resources("configmaps").Names("kube-scheduler").RuleOrDie(),
  105. },
  106. })
  107. delegatedAuthBinding := rbacv1helpers.NewRoleBinding("extension-apiserver-authentication-reader", metav1.NamespaceSystem).Users(user.KubeControllerManager, user.KubeScheduler).BindingOrDie()
  108. delegatedAuthBinding.Name = "system::extension-apiserver-authentication-reader"
  109. addNamespaceRoleBinding(metav1.NamespaceSystem, delegatedAuthBinding)
  110. addNamespaceRoleBinding(metav1.NamespaceSystem,
  111. rbacv1helpers.NewRoleBinding("system::leader-locking-kube-controller-manager", metav1.NamespaceSystem).Users(user.KubeControllerManager).SAs(metav1.NamespaceSystem, "kube-controller-manager").BindingOrDie())
  112. addNamespaceRoleBinding(metav1.NamespaceSystem,
  113. rbacv1helpers.NewRoleBinding("system::leader-locking-kube-scheduler", metav1.NamespaceSystem).Users(user.KubeScheduler).SAs(metav1.NamespaceSystem, "kube-scheduler").BindingOrDie())
  114. addNamespaceRoleBinding(metav1.NamespaceSystem,
  115. rbacv1helpers.NewRoleBinding(saRolePrefix+"bootstrap-signer", metav1.NamespaceSystem).SAs(metav1.NamespaceSystem, "bootstrap-signer").BindingOrDie())
  116. // cloud-provider is deprecated starting Kubernetes 1.10 and will be deleted according to GA deprecation policy.
  117. addNamespaceRoleBinding(metav1.NamespaceSystem,
  118. rbacv1helpers.NewRoleBinding(saRolePrefix+"cloud-provider", metav1.NamespaceSystem).SAs(metav1.NamespaceSystem, "cloud-provider").BindingOrDie())
  119. addNamespaceRoleBinding(metav1.NamespaceSystem,
  120. rbacv1helpers.NewRoleBinding(saRolePrefix+"token-cleaner", metav1.NamespaceSystem).SAs(metav1.NamespaceSystem, "token-cleaner").BindingOrDie())
  121. addNamespaceRole(metav1.NamespacePublic, rbacv1.Role{
  122. // role for the bootstrap signer to be able to write its configmap
  123. ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "bootstrap-signer"},
  124. Rules: []rbacv1.PolicyRule{
  125. rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("configmaps").RuleOrDie(),
  126. rbacv1helpers.NewRule("update").Groups(legacyGroup).Resources("configmaps").Names("cluster-info").RuleOrDie(),
  127. eventsRule(),
  128. },
  129. })
  130. addNamespaceRoleBinding(metav1.NamespacePublic,
  131. rbacv1helpers.NewRoleBinding(saRolePrefix+"bootstrap-signer", metav1.NamespacePublic).SAs(metav1.NamespaceSystem, "bootstrap-signer").BindingOrDie())
  132. }
  133. // NamespaceRoles returns a map of namespace to slice of roles to create
  134. func NamespaceRoles() map[string][]rbacv1.Role {
  135. return namespaceRoles
  136. }
  137. // NamespaceRoleBindings returns a map of namespace to slice of roles to create
  138. func NamespaceRoleBindings() map[string][]rbacv1.RoleBinding {
  139. return namespaceRoleBindings
  140. }