Skip to content

Commit 26c0a57

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #266 from tam7t/rbac-sync-choice
roles: split secret sync a separate role: secretprovidersyncing-role
2 parents 6538825 + 7c9db2d commit 26c0a57

14 files changed

+139
-38
lines changed

‎Makefile

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,8 @@ e2e-vault: install-driver
157157

158158
# Generate manifests e.g. CRD, RBAC etc.
159159
manifests: controller-gen
160-
$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=secretproviderclasses-role paths="./..." output:crd:artifacts:config=config/crd/bases
160+
# Generate the base CRD/RBAC
161+
$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=secretproviderclasses-role paths="./controllers" output:crd:artifacts:config=config/crd/bases
161162
cp config/crd/bases/* manifest_staging/charts/secrets-store-csi-driver/templates
162163
cp config/crd/bases/* manifest_staging/deploy/
163164

@@ -168,6 +169,14 @@ manifests: controller-gen
168169
@sed -i '1s/^/{{ if .Values.rbac.install }}\n/gm; s/namespace: .*/namespace: {{ .Release.Namespace }}/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role_binding.yaml
169170
@sed -i '1s/^/{{ if .Values.rbac.install }}\n/gm; s/namespace: .*/namespace: {{ .Release.Namespace }}/gm; $$s/$$/\n{{ include "sscd.labels" . | indent 2 }}\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/serviceaccount.yaml
170171

172+
# Generate secret syncing specific RBAC
173+
$(CONTROLLER_GEN) rbac:roleName=secretprovidersyncing-role paths="./controllers/syncsecret" output:dir=config/rbac-syncsecret
174+
$(KUSTOMIZE) build config/rbac-syncsecret -o manifest_staging/deploy/rbac-secretprovidersyncing.yaml
175+
cp config/rbac-syncsecret/role.yaml manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret.yaml
176+
cp config/rbac-syncsecret/role_binding.yaml manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret_binding.yaml
177+
@sed -i '1s/^/{{ if .Values.syncSecret.enabled }}\n/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret.yaml
178+
@sed -i '1s/^/{{ if .Values.syncSecret.enabled }}\n/gm; s/namespace: .*/namespace: {{ .Release.Namespace }}/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret_binding.yaml
179+
171180
# Run go fmt against code
172181
fmt:
173182
go fmt ./...

‎config/rbac-syncsecret/kustomization.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
resources:
2+
- role.yaml
3+
- role_binding.yaml

‎config/rbac-syncsecret/role.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
2+
---
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRole
5+
metadata:
6+
creationTimestamp: null
7+
name: secretprovidersyncing-role
8+
rules:
9+
- apiGroups:
10+
- ""
11+
resources:
12+
- secrets
13+
verbs:
14+
- create
15+
- delete
16+
- get
17+
- list
18+
- patch
19+
- update
20+
- watch

‎config/rbac-syncsecret/role_binding.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: secretprovidersyncing-rolebinding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: secretprovidersyncing-role
9+
subjects:
10+
- kind: ServiceAccount
11+
name: secrets-store-csi-driver
12+
namespace: default

‎config/rbac/role.yaml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,6 @@ metadata:
66
creationTimestamp: null
77
name: secretproviderclasses-role
88
rules:
9-
- apiGroups:
10-
- ""
11-
resources:
12-
- secrets
13-
verbs:
14-
- create
15-
- delete
16-
- get
17-
- list
18-
- patch
19-
- update
20-
- watch
219
- apiGroups:
2210
- secrets-store.csi.x-k8s.io
2311
resources:

‎controllers/secretproviderclasspodstatus_controller.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ type SecretProviderClassPodStatusReconciler struct {
6060
// +kubebuilder:rbac:groups=secrets-store.csi.x-k8s.io,resources=secretproviderclasspodstatuses,verbs=get;list;watch;create;update;patch;delete
6161
// +kubebuilder:rbac:groups=secrets-store.csi.x-k8s.io,resources=secretproviderclasspodstatuses/status,verbs=get;update;patch
6262
// +kubebuilder:rbac:groups=secrets-store.csi.x-k8s.io,resources=secretproviderclasses,verbs=get;list;watch
63-
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
6463

6564
func (r *SecretProviderClassPodStatusReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
6665
ctx := context.Background()

‎controllers/syncsecret/syncsecret.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/*
2+
Copyright 2020 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
// Package syncsecret holds the RBAC permission annotations for the controller
18+
// to sync k8s secrets so that they can be built and applied separately.
19+
package syncsecret
20+
21+
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete

‎manifest_staging/charts/secrets-store-csi-driver/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,4 +57,5 @@ The following table lists the configurable parameters of the csi-secrets-store-p
5757
| `livenessProbe.port` | Liveness probe port | `9808` |
5858
| `livenessProbe.logLevel` | Liveness probe container logging verbosity level | `2` |
5959
| `rbac.install` | Install default rbac roles and bindings | true |
60+
| `syncSecret.enabled` | Enable rbac roles and bindings required for syncing to Kubernetes native secrets (the default will change to false after v0.0.14) | true |
6061
| `minimumProviderVersions` | A comma delimited list of key-value pairs of minimum provider versions with driver | `""` |

‎manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{ if .Values.syncSecret.enabled }}
2+
3+
---
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
kind: ClusterRole
6+
metadata:
7+
creationTimestamp: null
8+
name: secretprovidersyncing-role
9+
rules:
10+
- apiGroups:
11+
- ""
12+
resources:
13+
- secrets
14+
verbs:
15+
- create
16+
- delete
17+
- get
18+
- list
19+
- patch
20+
- update
21+
- watch
22+
{{ end }}

‎manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret_binding.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{{ if .Values.syncSecret.enabled }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: secretprovidersyncing-rolebinding
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: ClusterRole
9+
name: secretprovidersyncing-role
10+
subjects:
11+
- kind: ServiceAccount
12+
name: secrets-store-csi-driver
13+
namespace: {{ .Release.Namespace }}
14+
{{ end }}

‎manifest_staging/charts/secrets-store-csi-driver/templates/role.yaml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,6 @@ metadata:
77
creationTimestamp: null
88
name: secretproviderclasses-role
99
rules:
10-
- apiGroups:
11-
- ""
12-
resources:
13-
- secrets
14-
verbs:
15-
- create
16-
- delete
17-
- get
18-
- list
19-
- patch
20-
- update
21-
- watch
2210
- apiGroups:
2311
- secrets-store.csi.x-k8s.io
2412
resources:

‎manifest_staging/charts/secrets-store-csi-driver/values.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ livenessProbe:
4949
rbac:
5050
install: true
5151

52+
## Install RBAC roles and bindings required for K8S Secrets syncing. Change this
53+
## to false after v0.0.14
54+
syncSecret:
55+
enabled: true
56+
5257
## Minimum Provider Versions (optional)
5358
## A comma delimited list of key-value pairs of minimum provider versions
5459
## e.g. provider1=0.0.2,provider2=0.0.3

‎manifest_staging/deploy/rbac-secretproviderclass.yaml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,6 @@ metadata:
1010
creationTimestamp: null
1111
name: secretproviderclasses-role
1212
rules:
13-
- apiGroups:
14-
- ""
15-
resources:
16-
- secrets
17-
verbs:
18-
- create
19-
- delete
20-
- get
21-
- list
22-
- patch
23-
- update
24-
- watch
2513
- apiGroups:
2614
- secrets-store.csi.x-k8s.io
2715
resources:

‎manifest_staging/deploy/rbac-secretprovidersyncing.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
creationTimestamp: null
5+
name: secretprovidersyncing-role
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- secrets
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
19+
---
20+
apiVersion: rbac.authorization.k8s.io/v1
21+
kind: ClusterRoleBinding
22+
metadata:
23+
name: secretprovidersyncing-rolebinding
24+
roleRef:
25+
apiGroup: rbac.authorization.k8s.io
26+
kind: ClusterRole
27+
name: secretprovidersyncing-role
28+
subjects:
29+
- kind: ServiceAccount
30+
name: secrets-store-csi-driver
31+
namespace: default

0 commit comments

Comments
 (0)