fine tune rbac (#1109)

* fine tune rbac Signed-off-by: Huamin Chen <[email protected]> * review feedback Signed-off-by: Huamin Chen <[email protected]>
knative · Jun 16, 2018 · 4d497a2 · 4d497a2
1 parent 174b11f
commit 4d497a2
Show file tree

Hide file tree

Showing 2 changed files with 61 additions and 2 deletions.
diff --git a/config/200-clusterrole.yaml b/config/200-clusterrole.yaml
@@ -0,0 +1,59 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-admin
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["ingresses","deployments"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["serving.knative.dev"]
+    resources: ["configurations", "configurationgenerations", "routes", "revisions", "revisionuids", "autoscalers", "services"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: ["build.dev"]
+    resources: ["builds"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]    
+  - apiGroups: ["config.istio.io"]
+    resources: ["routerules"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]    
+---    
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: knative-serving-write
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"]
+    verbs: ["get", "list", "update", "patch", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["ingresses","deployments"]
+    verbs: ["get", "list", "update", "patch", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets"]
+    verbs: ["get", "list", "update", "patch", "watch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "update", "patch", "watch"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "update", "patch", "watch"]
+  - apiGroups: ["serving.knative.dev"]
+    resources: ["configurations", "configurationgenerations", "routes", "revisions", "revisionuids", "autoscalers", "services"]
+    verbs: ["get", "list", "update", "patch", "watch"]
+  - apiGroups: ["build.dev"]
+    resources: ["builds"]
+    verbs: ["get", "list", "update", "patch", "watch"]    
+  - apiGroups: ["config.istio.io"]
+    resources: ["routerules"]
+    verbs: ["get", "list", "update", "patch", "watch"]    
diff --git a/config/201-clusterrolebinding.yaml b/config/201-clusterrolebinding.yaml
@@ -22,7 +22,7 @@ subjects:
     namespace: knative-serving-system
 roleRef:
   kind: ClusterRole
-  name: cluster-admin
+  name: knative-serving-admin
   apiGroup: rbac.authorization.k8s.io
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
@@ -35,5 +35,5 @@ subjects:
     namespace: knative-serving-system
 roleRef:
   kind: ClusterRole
-  name: cluster-admin
+  name: knative-serving-write
   apiGroup: rbac.authorization.k8s.io