restrict RBAC for kube controller secrets to the required namespace only #3602
Conversation
|
Please make sure you consider the multi-tenant configuration and understand if this impacts that configuration. |
vara2504
force-pushed
the
kubecontroller_rbac
branch
from
4623294
to
c588f19
Compare
|
Checked with the multi-tenant team, and we might not have any impact in the tenant namespace. |
pkg/render/logstorage.go
Outdated
| // to get configmaps and manipulate secrets | ||
| func (m managedClusterLogStorage) linseedExternalRolesAndBindings() ([]*rbacv1.ClusterRole, []*rbacv1.RoleBinding, []*rbacv1.ClusterRoleBinding) { | ||
| func (m managedClusterLogStorage) externalRolesAndBindings() ([]*rbacv1.Role, []*rbacv1.ClusterRole, []*rbacv1.RoleBinding, []*rbacv1.ClusterRoleBinding) { |
There was a problem hiding this comment.
I'd prefer if we kept this function scoped to Linseed, and introduced another one for the kube-controllers permissions.
pkg/render/logstorage.go
Outdated
| } | ||
|
|
||
| // Bind the secrets permission to the operator namespace. This binding now adds permissions for kube controllers to create | ||
| // its public cert secret in the tigera-operator namespace |
There was a problem hiding this comment.
Do you know why kube-controllers needs its public cert in the operator namespace? I'm struggling to recall what flow this is a part of.
There was a problem hiding this comment.
Updated. management cluster only needs tigera-ee-*-elasticsearch-access secrets in the tigera-operator namespace not any public certs. Public certs are needed only in the managed cluster.
vara2504
force-pushed
the
kubecontroller_rbac
branch
from
c588f19
to
ec9b169
Compare
vara2504
force-pushed
the
kubecontroller_rbac
branch
from
9690087
to
1399ffc
Compare
Removed the secrets resource from the calico-kube-controllers and es-calico-kube-controllers ClusterRole and created a new Role with secrets resource in the tigera-operator and tigera-elasticsearch namespaces. In both the enterprise and cloud environments, I see that all secrets managed by the kube-controllers belong to either of these namespaces.
Tested in standalone cluster, mgmt and managed cluster .
Description
For PR author
make gen-filesmake gen-versionsFor PR reviewers
A note for code reviewers - all pull requests must have the following:
kind/bugif this is a bugfix.kind/enhancementif this is a a new feature.enterpriseif this PR applies to Calico Enterprise only.