github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

allow the kubelet to request certificates 

This allows the rotation process to use the kubelet's credentials.
pull/6/head
Mike Danese 2017-02-03 11:51:26 -08:00
parent ab794c6128
commit 074f2da32a
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
View File

@ -217,6 +217,9 @@ func ClusterRoles() []rbac.ClusterRole {
// TODO: change glusterfs to use DNS lookup so this isn't needed? // TODO: change glusterfs to use DNS lookup so this isn't needed?
// Needed for glusterfs volumes // Needed for glusterfs volumes
rbac.NewRule("get").Groups(legacyGroup).Resources("endpoints").RuleOrDie(), rbac.NewRule("get").Groups(legacyGroup).Resources("endpoints").RuleOrDie(),
// Used to create a certificatesigningrequest for a node-specific client certificate, and watch
// for it to be signed. This allows the kubelet to rotate it's own certificate.
rbac.NewRule("create", "get", "list", "watch").Groups(certificatesGroup).Resources("certificatesigningrequests").RuleOrDie(),
}, },
}, },
{ {

9
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml vendored
View File

@ -569,6 +569,15 @@ items:
- endpoints - endpoints
verbs: verbs:
- get - get
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests
verbs:
- create
- get
- list
- watch
- apiVersion: rbac.authorization.k8s.io/v1beta1 - apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole kind: ClusterRole
metadata: metadata: