mirror of https://github.com/k3s-io/k3s
Merge pull request #40034 from liggitt/node-bootstrapper-role
Automatic merge from submit-queue Add node TLS bootstrapping role Adds a role describing permissions needed to complete the kubelet client bootstrap flow. Needed by kubeadm in https://github.com/kubernetes/kubernetes/pull/39846#discussion_r96491471pull/6/head
commit
fc8e029f8f
|
@ -230,6 +230,16 @@ func ClusterRoles() []rbac.ClusterRole {
|
||||||
eventsRule(),
|
eventsRule(),
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
// a role to use for bootstrapping a node's client certificates
|
||||||
|
ObjectMeta: api.ObjectMeta{Name: "system:node-bootstrapper"},
|
||||||
|
Rules: []rbac.PolicyRule{
|
||||||
|
// used to check if the node already exists
|
||||||
|
rbac.NewRule("get").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
|
||||||
|
// used to create a certificatesigningrequest for a node-specific client certificate, and watch for it to be signed
|
||||||
|
rbac.NewRule("create", "get", "list", "watch").Groups(certificatesGroup).Resources("certificatesigningrequests").RuleOrDie(),
|
||||||
|
},
|
||||||
|
},
|
||||||
{
|
{
|
||||||
// a role to use for allowing authentication and authorization delegation
|
// a role to use for allowing authentication and authorization delegation
|
||||||
ObjectMeta: api.ObjectMeta{Name: "system:auth-delegator"},
|
ObjectMeta: api.ObjectMeta{Name: "system:auth-delegator"},
|
||||||
|
|
|
@ -617,6 +617,31 @@ items:
|
||||||
- endpoints
|
- endpoints
|
||||||
verbs:
|
verbs:
|
||||||
- get
|
- get
|
||||||
|
- apiVersion: rbac.authorization.k8s.io/v1alpha1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
creationTimestamp: null
|
||||||
|
labels:
|
||||||
|
kubernetes.io/bootstrapping: rbac-defaults
|
||||||
|
name: system:node-bootstrapper
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
attributeRestrictions: null
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- certificates.k8s.io
|
||||||
|
attributeRestrictions: null
|
||||||
|
resources:
|
||||||
|
- certificatesigningrequests
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
- apiVersion: rbac.authorization.k8s.io/v1alpha1
|
- apiVersion: rbac.authorization.k8s.io/v1alpha1
|
||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
metadata:
|
metadata:
|
||||||
|
|
Loading…
Reference in New Issue