From 170f2ed2fbf58857dbd947deb3246702d1f8f014 Mon Sep 17 00:00:00 2001
From: Adam Harrison <harrisonadamw@gmail.com>
Date: Tue, 5 Jun 2018 15:25:14 +0100
Subject: [PATCH] Restrict update permissions on daemonsets

Kured only needs update permissions on its own daeemonset.
---
 kured-rbac.yaml | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/kured-rbac.yaml b/kured-rbac.yaml
index 89076c6..b48d650 100644
--- a/kured-rbac.yaml
+++ b/kured-rbac.yaml
@@ -4,10 +4,6 @@ kind: ClusterRole
 metadata:
   name: kured
 rules:
-# Allow kured to grab it's lock
-- apiGroups: ["extensions"]
-  resources: ["daemonsets"]
-  verbs:     ["get", "update"]
 # Allow kured to cordon and uncordon nodes
 - apiGroups: [""]
   resources: ["nodes"]
@@ -41,3 +37,29 @@ subjects:
 - kind: ServiceAccount
   name: kured
   namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: kube-system
+  name: kured
+rules:
+# Allow kured to lock/unlock itself
+- apiGroups:     ["extensions"]
+  resources:     ["daemonsets"]
+  resourceNames: ["kured"]
+  verbs:         ["update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  namespace: kube-system
+  name: kured
+subjects:
+- kind: ServiceAccount
+  namespace: kube-system
+  name: kured
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kured