Skip to content

Commit c5f729f

Browse files
FuristoFuristo
committed
[installer] Configure roles and bindings
1 parent 338da73 commit c5f729f

File tree

2 files changed

+149
-112
lines changed

2 files changed

+149
-112
lines changed

‎install/installer/pkg/components/ws-manager-mk2/role.go

Lines changed: 125 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,121 @@ import (
1212
"k8s.io/apimachinery/pkg/runtime"
1313
)
1414

15+
var controllerRules = []rbacv1.PolicyRule{
16+
{
17+
APIGroups: []string{""},
18+
Resources: []string{"pods"},
19+
Verbs: []string{
20+
"create",
21+
"delete",
22+
"get",
23+
"list",
24+
"patch",
25+
"update",
26+
"watch",
27+
},
28+
},
29+
{
30+
Verbs: []string{"get"},
31+
APIGroups: []string{""},
32+
Resources: []string{"pod/status"},
33+
},
34+
{
35+
APIGroups: []string{"workspace.gitpod.io"},
36+
Resources: []string{"workspaces"},
37+
Verbs: []string{
38+
"create",
39+
"delete",
40+
"get",
41+
"list",
42+
"patch",
43+
"update",
44+
"watch",
45+
},
46+
},
47+
{
48+
Verbs: []string{"update"},
49+
APIGroups: []string{"workspace.gitpod.io"},
50+
Resources: []string{"workspaces/finalizers"},
51+
},
52+
{
53+
APIGroups: []string{"workspace.gitpod.io"},
54+
Resources: []string{"workspaces/status"},
55+
Verbs: []string{
56+
"get",
57+
"patch",
58+
"update",
59+
},
60+
},
61+
{
62+
APIGroups: []string{"workspace.gitpod.io"},
63+
Resources: []string{"snapshots"},
64+
Verbs: []string{
65+
"create",
66+
"delete",
67+
"get",
68+
"list",
69+
"watch",
70+
},
71+
},
72+
{
73+
APIGroups: []string{"workspace.gitpod.io"},
74+
Resources: []string{"snapshots/status"},
75+
Verbs: []string{
76+
"get",
77+
},
78+
},
79+
{
80+
APIGroups: []string{""},
81+
Resources: []string{"secrets"},
82+
Verbs: []string{
83+
"create",
84+
"delete",
85+
"get",
86+
"list",
87+
"watch",
88+
},
89+
},
90+
}
91+
92+
// ConfigMap, Leases, and Events access is required for leader-election.
93+
var leaderElectionRules = []rbacv1.PolicyRule{
94+
{
95+
APIGroups: []string{""},
96+
Resources: []string{"configmaps"},
97+
Verbs: []string{
98+
"create",
99+
"delete",
100+
"get",
101+
"list",
102+
"patch",
103+
"update",
104+
"watch",
105+
},
106+
},
107+
{
108+
APIGroups: []string{"coordination.k8s.io"},
109+
Resources: []string{"leases"},
110+
Verbs: []string{
111+
"create",
112+
"delete",
113+
"get",
114+
"list",
115+
"patch",
116+
"update",
117+
"watch",
118+
},
119+
},
120+
{
121+
APIGroups: []string{""},
122+
Resources: []string{"events"},
123+
Verbs: []string{
124+
"create",
125+
"patch",
126+
},
127+
},
128+
}
129+
15130
func role(ctx *common.RenderContext) ([]runtime.Object, error) {
16131
labels := common.DefaultLabels(Component)
17132

@@ -23,117 +138,17 @@ func role(ctx *common.RenderContext) ([]runtime.Object, error) {
23138
Namespace: ctx.Namespace,
24139
Labels: labels,
25140
},
26-
Rules: []rbacv1.PolicyRule{
27-
{
28-
APIGroups: []string{""},
29-
Resources: []string{"pods"},
30-
Verbs: []string{
31-
"create",
32-
"delete",
33-
"get",
34-
"list",
35-
"patch",
36-
"update",
37-
"watch",
38-
},
39-
},
40-
{
41-
Verbs: []string{"get"},
42-
APIGroups: []string{""},
43-
Resources: []string{"pod/status"},
44-
},
45-
{
46-
APIGroups: []string{"workspace.gitpod.io"},
47-
Resources: []string{"workspaces"},
48-
Verbs: []string{
49-
"create",
50-
"delete",
51-
"get",
52-
"list",
53-
"patch",
54-
"update",
55-
"watch",
56-
},
57-
},
58-
{
59-
Verbs: []string{"update"},
60-
APIGroups: []string{"workspace.gitpod.io"},
61-
Resources: []string{"workspaces/finalizers"},
62-
},
63-
{
64-
APIGroups: []string{"workspace.gitpod.io"},
65-
Resources: []string{"workspaces/status"},
66-
Verbs: []string{
67-
"get",
68-
"patch",
69-
"update",
70-
},
71-
},
72-
{
73-
APIGroups: []string{"workspace.gitpod.io"},
74-
Resources: []string{"snapshots"},
75-
Verbs: []string{
76-
"create",
77-
"delete",
78-
"get",
79-
"list",
80-
"watch",
81-
},
82-
},
83-
{
84-
APIGroups: []string{"workspace.gitpod.io"},
85-
Resources: []string{"snapshots/status"},
86-
Verbs: []string{
87-
"get",
88-
},
89-
},
90-
// ConfigMap, Leases, and Events access is required for leader-election.
91-
{
92-
APIGroups: []string{""},
93-
Resources: []string{"configmaps"},
94-
Verbs: []string{
95-
"create",
96-
"delete",
97-
"get",
98-
"list",
99-
"patch",
100-
"update",
101-
"watch",
102-
},
103-
},
104-
{
105-
APIGroups: []string{"coordination.k8s.io"},
106-
Resources: []string{"leases"},
107-
Verbs: []string{
108-
"create",
109-
"delete",
110-
"get",
111-
"list",
112-
"patch",
113-
"update",
114-
"watch",
115-
},
116-
},
117-
{
118-
APIGroups: []string{""},
119-
Resources: []string{"events"},
120-
Verbs: []string{
121-
"create",
122-
"patch",
123-
},
124-
},
125-
{
126-
APIGroups: []string{""},
127-
Resources: []string{"secrets"},
128-
Verbs: []string{
129-
"create",
130-
"delete",
131-
"get",
132-
"list",
133-
"watch",
134-
},
135-
},
141+
Rules: append(controllerRules, leaderElectionRules...),
142+
},
143+
144+
&rbacv1.Role{
145+
TypeMeta: common.TypeMetaRole,
146+
ObjectMeta: metav1.ObjectMeta{
147+
Name: Component,
148+
Namespace: WorkspaceSecretsNamespace,
149+
Labels: labels,
136150
},
151+
Rules: controllerRules,
137152
},
138153
}, nil
139154
}

‎install/installer/pkg/components/ws-manager-mk2/rolebinding.go

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,30 @@ func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
5151
},
5252
Subjects: []rbacv1.Subject{
5353
{
54-
Kind: "ServiceAccount",
55-
Name: Component,
54+
Kind: "ServiceAccount",
55+
Name: Component,
56+
Namespace: ctx.Namespace,
57+
},
58+
},
59+
},
60+
61+
&rbacv1.RoleBinding{
62+
TypeMeta: common.TypeMetaRoleBinding,
63+
ObjectMeta: metav1.ObjectMeta{
64+
Name: Component,
65+
Namespace: WorkspaceSecretsNamespace,
66+
Labels: labels,
67+
},
68+
RoleRef: rbacv1.RoleRef{
69+
APIGroup: "rbac.authorization.k8s.io",
70+
Kind: "Role",
71+
Name: Component,
72+
},
73+
Subjects: []rbacv1.Subject{
74+
{
75+
Kind: "ServiceAccount",
76+
Name: Component,
77+
Namespace: ctx.Namespace,
5678
},
5779
},
5880
},

0 commit comments

Comments
 (0)