From 11780f008a199f6cd7a94561a21c0f49ceaf36ba Mon Sep 17 00:00:00 2001 From: David Miller Date: Thu, 23 Nov 2017 11:48:14 -0500 Subject: [PATCH 1/5] Update provided manifests to support a service account and RBAC - Added kured service account - Added kured clusterrole - Added kured clusterrolebinding - Updated README.md documentation to include deploying with RBAC support --- README.md | 8 +++++- kured-ds.yaml | 7 +++++ kured-rbac.yaml | 70 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 kured-rbac.yaml diff --git a/README.md b/README.md index fd3795b..dc853cb 100644 --- a/README.md +++ b/README.md @@ -48,12 +48,18 @@ To obtain a default installation without Prometheus alerting interlock or Slack notifications: ``` -kubectl apply -f https://github.com/weaveworks/kured/releases/download/1.0.0/kured-ds.yaml +kubectl apply -f https://raw.githubusercontent.com/weaveworks/kured/master/kured-ds.yaml ``` If you want to customise the installation, download the manifest and edit it in accordance with the following section before application. +For RBAC support apply the RBAC manifest. + +``` +kubectl apply -f https://raw.githubusercontent.com/weaveworks/kured/master/kured-rbac.yaml +``` + ## Configuration The following arguments can be passed to kured via the daemonset pod template: diff --git a/kured-ds.yaml b/kured-ds.yaml index d56651f..941daf3 100644 --- a/kured-ds.yaml +++ b/kured-ds.yaml @@ -1,3 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kured + namespace: kube-system +--- apiVersion: extensions/v1beta1 kind: DaemonSet metadata: @@ -9,6 +15,7 @@ spec: labels: name: kured spec: + serviceAccountName: kured containers: - name: kured image: quay.io/weaveworks/kured diff --git a/kured-rbac.yaml b/kured-rbac.yaml new file mode 100644 index 0000000..a389569 --- /dev/null +++ b/kured-rbac.yaml @@ -0,0 +1,70 @@ +# ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kured +rules: +# Allow kured to grab it's lock +- apiGroups: + - extensions + resources: + - daemonsets + verbs: + - get + - update +# Allow kured to cordon and uncordon nodes +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - update +# Allow kured to drain nodes +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - delete +- apiGroups: + - apps + resources: + - statefulsets + verbs: + - get +- apiGroups: + - extensions + resources: + - daemonsets + - replicasets + verbs: + - get +- apiGroups: + - batch + resources: + - jobs + verbs: + - get +- apiGroups: + - "" + resources: + - pods/eviction + verbs: + - create +--- +# CLusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kured +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kured +subjects: +- kind: ServiceAccount + name: kured + namespace: kube-system From 741b27cd35df639cc607a81efd300ebcc4e9f695 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Tue, 5 Jun 2018 15:14:10 +0100 Subject: [PATCH 2/5] Revert documentation change The manifest on master is for development, normal users should use a released version. I'll do a release with RBAC shortly. --- README.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/README.md b/README.md index dc853cb..fd3795b 100644 --- a/README.md +++ b/README.md @@ -48,18 +48,12 @@ To obtain a default installation without Prometheus alerting interlock or Slack notifications: ``` -kubectl apply -f https://raw.githubusercontent.com/weaveworks/kured/master/kured-ds.yaml +kubectl apply -f https://github.com/weaveworks/kured/releases/download/1.0.0/kured-ds.yaml ``` If you want to customise the installation, download the manifest and edit it in accordance with the following section before application. -For RBAC support apply the RBAC manifest. - -``` -kubectl apply -f https://raw.githubusercontent.com/weaveworks/kured/master/kured-rbac.yaml -``` - ## Configuration The following arguments can be passed to kured via the daemonset pod template: From 152534fcc8a5c92e0dbb173812699f8734b816fb Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Tue, 5 Jun 2018 15:16:45 +0100 Subject: [PATCH 3/5] Convert to compact representation --- kured-ds.yaml | 1 + kured-rbac.yaml | 71 +++++++++++++++---------------------------------- 2 files changed, 23 insertions(+), 49 deletions(-) diff --git a/kured-ds.yaml b/kured-ds.yaml index 941daf3..2bbad72 100644 --- a/kured-ds.yaml +++ b/kured-ds.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: ServiceAccount metadata: diff --git a/kured-rbac.yaml b/kured-rbac.yaml index a389569..89076c6 100644 --- a/kured-rbac.yaml +++ b/kured-rbac.yaml @@ -1,61 +1,34 @@ -# ClusterRole +--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: kured rules: # Allow kured to grab it's lock -- apiGroups: - - extensions - resources: - - daemonsets - verbs: - - get - - update +- apiGroups: ["extensions"] + resources: ["daemonsets"] + verbs: ["get", "update"] # Allow kured to cordon and uncordon nodes -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - update +- apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "update"] # Allow kured to drain nodes -- apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - - delete -- apiGroups: - - apps - resources: - - statefulsets - verbs: - - get -- apiGroups: - - extensions - resources: - - daemonsets - - replicasets - verbs: - - get -- apiGroups: - - batch - resources: - - jobs - verbs: - - get -- apiGroups: - - "" - resources: - - pods/eviction - verbs: - - create +- apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "delete"] +- apiGroups: ["apps"] + resources: ["statefulsets"] + verbs: ["get"] +- apiGroups: ["extensions"] + resources: ["daemonsets", "replicasets"] + verbs: ["get"] +- apiGroups: ["batch"] + resources: ["jobs"] + verbs: ["get"] +- apiGroups: [""] + resources: ["pods/eviction"] + verbs: ["create"] --- -# CLusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: From 170f2ed2fbf58857dbd947deb3246702d1f8f014 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Tue, 5 Jun 2018 15:25:14 +0100 Subject: [PATCH 4/5] Restrict update permissions on daemonsets Kured only needs update permissions on its own daeemonset. --- kured-rbac.yaml | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/kured-rbac.yaml b/kured-rbac.yaml index 89076c6..b48d650 100644 --- a/kured-rbac.yaml +++ b/kured-rbac.yaml @@ -4,10 +4,6 @@ kind: ClusterRole metadata: name: kured rules: -# Allow kured to grab it's lock -- apiGroups: ["extensions"] - resources: ["daemonsets"] - verbs: ["get", "update"] # Allow kured to cordon and uncordon nodes - apiGroups: [""] resources: ["nodes"] @@ -41,3 +37,29 @@ subjects: - kind: ServiceAccount name: kured namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: kube-system + name: kured +rules: +# Allow kured to lock/unlock itself +- apiGroups: ["extensions"] + resources: ["daemonsets"] + resourceNames: ["kured"] + verbs: ["update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + namespace: kube-system + name: kured +subjects: +- kind: ServiceAccount + namespace: kube-system + name: kured +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kured From b2aa60829418cb1d5d0923a7c12765dbb26db7cf Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Tue, 5 Jun 2018 15:51:33 +0100 Subject: [PATCH 5/5] Update permissions for kubectl 1.9.6 The permissions required by `kubectl drain` vary from version to version; this change brings them into line with the one currently bundled. --- kured-rbac.yaml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/kured-rbac.yaml b/kured-rbac.yaml index b48d650..6fad9e1 100644 --- a/kured-rbac.yaml +++ b/kured-rbac.yaml @@ -4,14 +4,21 @@ kind: ClusterRole metadata: name: kured rules: -# Allow kured to cordon and uncordon nodes +# Allow kured to read spec.unschedulable +# Allow kubectl to drain/uncordon +# +# NB: These permissions are tightly coupled to the bundled version of kubectl; the ones below +# match https://github.com/kubernetes/kubernetes/blob/v1.9.6/pkg/kubectl/cmd/drain.go +# - apiGroups: [""] resources: ["nodes"] - verbs: ["get", "update"] -# Allow kured to drain nodes + verbs: ["get", "patch"] - apiGroups: [""] resources: ["pods"] - verbs: ["get", "list", "delete"] + verbs: ["list"] +- apiGroups: [""] + resources: ["replicationcontrollers"] + verbs: ["get"] - apiGroups: ["apps"] resources: ["statefulsets"] verbs: ["get"]