Skip to content

RBAC policies through kubectl apply -f rbac-namespace-default/ #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Aug 5, 2017
Merged

RBAC policies through kubectl apply -f rbac-namespace-default/ #59

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
7cf2a5d
RBAC rights are purely additive so ...
solsson Aug 5, 2017
05107fd
I don't really care, but which yaml indentation is winning?
solsson Aug 5, 2017
a8ee55b
With default service account curl works again
solsson Aug 5, 2017
3597426
Got the feeling from kubectl get clusterrole ...
solsson Aug 5, 2017
8f637b7
Recommends that you create rbac
solsson Aug 5, 2017
27421fb
Shows how to see that you need rbac, but makes readme heavier
solsson Aug 5, 2017
1c6b7bb
Addons can maintain their policies, so moving this to
solsson Aug 5, 2017
79d65fd
Details will live in the respective policies
solsson Aug 5, 2017
13520a6
Moved to its PR, multizone-rack-awareness
solsson Aug 5, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Details will live in the respective policies
  • Loading branch information
@solsson
solsson committed Aug 5, 2017
commit 79d65fd2e35b29df9cc936ceba3e4b4a1c151201
9 changes: 0 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,15 +59,6 @@ For clusters that enfoce [RBAC](https://kubernetes.io/docs/admin/authorization/r
kubectl apply -f rbac-namespace-default/
```

For example here's how you see that `kafka`s init containers need RBAC for [rack awareness](https://github.com/Yolean/kubernetes-kafka/pull/41):
```
$ kubectl exec kafka-1 -- cat /etc/kafka/server.properties | grep broker.rack
#init#broker.rack=# zone lookup failed, see -c init-config logs
$ kubectl logs -c init-config kafka-0
++ kubectl get node some-node '-o=go-template={{index .metadata.labels "failure-domain.beta.kubernetes.io/zone"}}'
Error from server (Forbidden): User "system:serviceaccount:kafka:default" cannot get nodes at the cluster scope.: "Unknown user \"system:serviceaccount:kafka:default\""
```

# Tests

```
Expand Down
9 changes: 8 additions & 1 deletion rbac-namespace-default/node-reader.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
# For kubectl get node, required for kafka init container rack awareness
# To see if init containers need RBAC:
#
# $ kubectl exec kafka-1 -- cat /etc/kafka/server.properties | grep broker.rack
# #init#broker.rack=# zone lookup failed, see -c init-config logs
# $ kubectl logs -c init-config kafka-0
# ++ kubectl get node some-node '-o=go-template={{index .metadata.labels "failure-domain.beta.kubernetes.io/zone"}}'
# Error from server (Forbidden): User "system:serviceaccount:kafka:default" cannot get nodes at the cluster scope.: "Unknown user \"system:serviceaccount:kafka:default\""
#
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
Expand Down