Skip to content

Commit ae096cd

Browse files
authored
✨ optimize rbac across controllers (#10552)
* optimize rbac across controllers * add update verb where patch is already allowed * add get and watch verb where list is already allowed * RBAC: remove permissions on finalizers subresource because we never use the subresource directly
1 parent 760964a commit ae096cd

File tree

23 files changed

+40
-115
lines changed

23 files changed

+40
-115
lines changed

bootstrap/kubeadm/config/rbac/role.yaml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ rules:
88
- ""
99
resources:
1010
- configmaps
11-
- events
1211
- secrets
1312
verbs:
1413
- create
@@ -34,7 +33,6 @@ rules:
3433
- bootstrap.cluster.x-k8s.io
3534
resources:
3635
- kubeadmconfigs
37-
- kubeadmconfigs/finalizers
3836
- kubeadmconfigs/status
3937
verbs:
4038
- create
@@ -58,3 +56,9 @@ rules:
5856
- get
5957
- list
6058
- watch
59+
- apiGroups:
60+
- ""
61+
resources:
62+
- events
63+
verbs:
64+
- create

bootstrap/kubeadm/internal/controllers/kubeadmconfig_controller.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,10 @@ type InitLocker interface {
7272
Unlock(ctx context.Context, cluster *clusterv1.Cluster) bool
7373
}
7474

75-
// +kubebuilder:rbac:groups=bootstrap.cluster.x-k8s.io,resources=kubeadmconfigs;kubeadmconfigs/status;kubeadmconfigs/finalizers,verbs=get;list;watch;create;update;patch;delete
75+
// +kubebuilder:rbac:groups=bootstrap.cluster.x-k8s.io,resources=kubeadmconfigs;kubeadmconfigs/status,verbs=get;list;watch;create;update;patch;delete
7676
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters;clusters/status;machinesets;machines;machines/status;machinepools;machinepools/status,verbs=get;list;watch
77-
// +kubebuilder:rbac:groups="",resources=secrets;events;configmaps,verbs=get;list;watch;create;update;patch;delete
77+
// +kubebuilder:rbac:groups="",resources=secrets;configmaps,verbs=get;list;watch;create;update;patch;delete
78+
// +kubebuilder:rbac:groups=core,resources=events,verbs=create
7879

7980
// KubeadmConfigReconciler reconciles a KubeadmConfig object.
8081
type KubeadmConfigReconciler struct {

config/rbac/role.yaml

Lines changed: 2 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ rules:
2727
- apiGroups:
2828
- addons.cluster.x-k8s.io
2929
resources:
30-
- clusterresourcesets/finalizers
3130
- clusterresourcesets/status
3231
verbs:
3332
- get
@@ -85,8 +84,6 @@ rules:
8584
resources:
8685
- clusterclasses
8786
verbs:
88-
- create
89-
- delete
9087
- get
9188
- list
9289
- patch
@@ -115,24 +112,8 @@ rules:
115112
- cluster.x-k8s.io
116113
resources:
117114
- clusters
118-
- clusters/finalizers
119115
- clusters/status
120116
verbs:
121-
- create
122-
- delete
123-
- get
124-
- list
125-
- patch
126-
- update
127-
- watch
128-
- apiGroups:
129-
- cluster.x-k8s.io
130-
resources:
131-
- clusters
132-
- clusters/status
133-
verbs:
134-
- create
135-
- delete
136117
- get
137118
- list
138119
- patch
@@ -154,18 +135,6 @@ rules:
154135
- cluster.x-k8s.io
155136
resources:
156137
- machinedeployments
157-
- machinedeployments/finalizers
158-
verbs:
159-
- get
160-
- list
161-
- patch
162-
- update
163-
- watch
164-
- apiGroups:
165-
- cluster.x-k8s.io
166-
resources:
167-
- machinedeployments
168-
- machinedeployments/finalizers
169138
- machinedeployments/status
170139
verbs:
171140
- create
@@ -191,7 +160,6 @@ rules:
191160
- cluster.x-k8s.io
192161
resources:
193162
- machinehealthchecks
194-
- machinehealthchecks/finalizers
195163
- machinehealthchecks/status
196164
verbs:
197165
- get
@@ -215,7 +183,6 @@ rules:
215183
- cluster.x-k8s.io
216184
resources:
217185
- machinepools
218-
- machinepools/finalizers
219186
- machinepools/status
220187
verbs:
221188
- create
@@ -229,7 +196,6 @@ rules:
229196
- cluster.x-k8s.io
230197
resources:
231198
- machines
232-
- machines/finalizers
233199
- machines/status
234200
verbs:
235201
- create
@@ -239,29 +205,10 @@ rules:
239205
- patch
240206
- update
241207
- watch
242-
- apiGroups:
243-
- cluster.x-k8s.io
244-
resources:
245-
- machines
246-
- machines/status
247-
verbs:
248-
- delete
249-
- get
250-
- list
251-
- watch
252-
- apiGroups:
253-
- cluster.x-k8s.io
254-
resources:
255-
- machinesets
256-
verbs:
257-
- get
258-
- list
259-
- watch
260208
- apiGroups:
261209
- cluster.x-k8s.io
262210
resources:
263211
- machinesets
264-
- machinesets/finalizers
265212
verbs:
266213
- get
267214
- list
@@ -272,7 +219,6 @@ rules:
272219
- cluster.x-k8s.io
273220
resources:
274221
- machinesets
275-
- machinesets/finalizers
276222
- machinesets/status
277223
verbs:
278224
- create
@@ -290,29 +236,14 @@ rules:
290236
- get
291237
- list
292238
- patch
239+
- update
293240
- watch
294241
- apiGroups:
295242
- ""
296243
resources:
297244
- events
298245
verbs:
299246
- create
300-
- get
301-
- list
302-
- patch
303-
- watch
304-
- apiGroups:
305-
- ""
306-
resources:
307-
- nodes
308-
verbs:
309-
- create
310-
- delete
311-
- get
312-
- list
313-
- patch
314-
- update
315-
- watch
316247
- apiGroups:
317248
- ""
318249
resources:
@@ -323,6 +254,7 @@ rules:
323254
- get
324255
- list
325256
- patch
257+
- update
326258
- watch
327259
- apiGroups:
328260
- ipam.cluster.x-k8s.io

controlplane/kubeadm/config/rbac/role.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,9 @@ rules:
5252
resources:
5353
- machinepools
5454
verbs:
55+
- get
5556
- list
57+
- watch
5658
- apiGroups:
5759
- cluster.x-k8s.io
5860
resources:
@@ -72,10 +74,6 @@ rules:
7274
- events
7375
verbs:
7476
- create
75-
- get
76-
- list
77-
- patch
78-
- watch
7977
- apiGroups:
8078
- ""
8179
resources:

controlplane/kubeadm/internal/controllers/controller.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,12 @@ const (
6262
kubeadmControlPlaneKind = "KubeadmControlPlane"
6363
)
6464

65-
// +kubebuilder:rbac:groups=core,resources=events,verbs=get;list;watch;create;patch
65+
// +kubebuilder:rbac:groups=core,resources=events,verbs=create
6666
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch
6767
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io;bootstrap.cluster.x-k8s.io;controlplane.cluster.x-k8s.io,resources=*,verbs=get;list;watch;create;update;patch;delete
6868
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters;clusters/status,verbs=get;list;watch
6969
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines;machines/status,verbs=get;list;watch;create;update;patch;delete
70-
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinepools,verbs=list
70+
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinepools,verbs=get;list;watch
7171
// +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch
7272

7373
// KubeadmControlPlaneReconciler reconciles a KubeadmControlPlane object.

exp/addons/internal/controllers/clusterresourceset_controller.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,9 @@ import (
5252
var ErrSecretTypeNotSupported = errors.New("unsupported secret type")
5353

5454
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;patch
55-
// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;patch
55+
// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;patch;update
5656
// +kubebuilder:rbac:groups=addons.cluster.x-k8s.io,resources=*,verbs=get;list;watch;create;update;patch;delete
57-
// +kubebuilder:rbac:groups=addons.cluster.x-k8s.io,resources=clusterresourcesets/status;clusterresourcesets/finalizers,verbs=get;update;patch
57+
// +kubebuilder:rbac:groups=addons.cluster.x-k8s.io,resources=clusterresourcesets/status,verbs=get;update;patch
5858

5959
// ClusterResourceSetReconciler reconciles a ClusterResourceSet object.
6060
type ClusterResourceSetReconciler struct {

exp/internal/controllers/machinepool_controller.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,10 @@ import (
5050
"sigs.k8s.io/cluster-api/util/predicates"
5151
)
5252

53-
// +kubebuilder:rbac:groups=core,resources=events,verbs=get;list;watch;create;patch
53+
// +kubebuilder:rbac:groups=core,resources=events,verbs=create
5454
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
55-
// +kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch;create;update;patch;delete
5655
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io;bootstrap.cluster.x-k8s.io,resources=*,verbs=get;list;watch;create;update;patch;delete
57-
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinepools;machinepools/status;machinepools/finalizers,verbs=get;list;watch;create;update;patch;delete
56+
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinepools;machinepools/status,verbs=get;list;watch;create;update;patch;delete
5857

5958
var (
6059
// machinePoolKind contains the schema.GroupVersionKind for the MachinePool type.

internal/controllers/cluster/cluster_controller.go

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,10 @@ const (
5858
deleteRequeueAfter = 5 * time.Second
5959
)
6060

61-
// +kubebuilder:rbac:groups=core,resources=events,verbs=get;list;watch;create;patch
62-
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;patch
63-
// +kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch;create;update;patch;delete
61+
// +kubebuilder:rbac:groups=core,resources=events,verbs=create
62+
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;patch;update
6463
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io;bootstrap.cluster.x-k8s.io;controlplane.cluster.x-k8s.io,resources=*,verbs=get;list;watch;create;update;patch;delete
65-
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters;clusters/status;clusters/finalizers,verbs=get;list;watch;create;update;patch;delete
64+
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters;clusters/status,verbs=get;list;watch;update;patch
6665
// +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch
6766

6867
// Reconciler reconciles a Cluster object.

internal/controllers/machine/machine_controller.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,10 @@ var (
6565
errControlPlaneIsBeingDeleted = errors.New("control plane is being deleted")
6666
)
6767

68-
// +kubebuilder:rbac:groups=core,resources=events,verbs=get;list;watch;create;patch
68+
// +kubebuilder:rbac:groups=core,resources=events,verbs=create
6969
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
70-
// +kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch;create;update;patch;delete
7170
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io;bootstrap.cluster.x-k8s.io,resources=*,verbs=get;list;watch;create;update;patch;delete
72-
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines;machines/status;machines/finalizers,verbs=get;list;watch;create;update;patch;delete
71+
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines;machines/status,verbs=get;list;watch;create;update;patch;delete
7372
// +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch
7473

7574
// Reconciler reconciles a Machine object.

internal/controllers/machinedeployment/machinedeployment_controller.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,10 @@ var (
5555
// in the MachineDeployment controller.
5656
const machineDeploymentManagerName = "capi-machinedeployment"
5757

58-
// +kubebuilder:rbac:groups=core,resources=events,verbs=get;list;watch;create;patch
58+
// +kubebuilder:rbac:groups=core,resources=events,verbs=create
5959
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
60-
// +kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch;create;update;patch;delete
6160
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io;bootstrap.cluster.x-k8s.io,resources=*,verbs=get;list;watch;create;update;patch;delete
62-
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinedeployments;machinedeployments/status;machinedeployments/finalizers,verbs=get;list;watch;create;update;patch;delete
61+
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinedeployments;machinedeployments/status,verbs=get;list;watch;create;update;patch;delete
6362

6463
// Reconciler reconciles a MachineDeployment object.
6564
type Reconciler struct {

0 commit comments

Comments
 (0)