Document some of the Antrea Agent RBAC permissions

[antoninbas]

And how to restrict them using Gatekeeper / OPA.

Signed-off-by: Antonin Bas [email protected]

[antoninbas]

I tested the Gatekeeper policies on a test cluster.

Starting with K8s v1.24, kubectl supports a --subresource flag and the following commands can be run from the antrea-agent Pod for validation:

# should succeed
kubectl patch --type='json' --subresource status node/<NODE_NAME> -p '[{"op":"add","path":"/metadata/annotations/foo","value": "bar"}]'
# should fail
kubectl patch --type='json' --subresource status node/<NODE_NAME> -p '[{"op":"add","path":"/metadata/labels/foo","value": "bar"}]'

[codecov-commenter]

Codecov Report

Merging #3694 (5019cca) into main (af56766) will decrease coverage by 11.98%.
The diff coverage is n/a.

@@             Coverage Diff             @@
##             main    #3694       +/-   ##
===========================================
- Coverage   64.53%   52.54%   -11.99%     
===========================================
  Files         278      392      +114     
  Lines       39510    55085    +15575     
===========================================
+ Hits        25497    28945     +3448     
- Misses      12038    23818    +11780     
- Partials     1975     2322      +347     

Flag	Coverage Δ
integration-tests	38.01% <ø> (?)
kind-e2e-tests	39.75% <ø> (-12.36%)	⬇️
unit-tests	43.83% <ø> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/agent/controller/networkpolicy/reject.go	0.00% <0.00%> (-85.89%)	⬇️
...g/agent/apiserver/handlers/featuregates/handler.go	4.54% <0.00%> (-77.28%)	⬇️
pkg/agent/controller/networkpolicy/packetin.go	0.00% <0.00%> (-66.91%)	⬇️
pkg/controller/networkpolicy/mutate.go	0.00% <0.00%> (-63.48%)	⬇️
pkg/apis/controlplane/v1beta2/helper.go	40.00% <0.00%> (-60.00%)	⬇️
pkg/controller/egress/store/egressgroup.go	1.72% <0.00%> (-54.32%)	⬇️
pkg/apiserver/handlers/webhook/mutation_crd.go	0.00% <0.00%> (-52.18%)	⬇️
...kg/apiserver/registry/system/supportbundle/rest.go	22.17% <0.00%> (-50.44%)	⬇️
pkg/util/logdir/logdir.go	0.00% <0.00%> (-50.00%)	⬇️
pkg/support/dump.go	7.90% <0.00%> (-49.16%)	⬇️
... and 179 more

[tnqn]

LGTM except the typo Xu pointed out

[xliuxu]

LGTM

[antoninbas]

/skip-all