bump kubernetes dashboard version

[gianrubio]

• bump dashboard to v1.6.1
• rbac rules for k8s dashboard

---

This change is 

[k8s-ci-robot]

Hi @gianrubio. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with @k8s-bot ok to test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[chrislovecnm]

/assign @sethpollack

[k8s-ci-robot]

@chrislovecnm: GitHub didn't allow me to assign the following users: sethpollack.

Note that only kubernetes members can be assigned.

In response to this:

/assign @sethpollack

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[chrislovecnm]

@sethpollack can you review?

[chrislovecnm]

@k8s-bot ok to test

[sethpollack]

I don't think we want to just assume that the dashboard should have cluster-admin access.

[gianrubio]

I borrowed this rules from the upstream https://github.com/kubernetes/dashboard/pull/1856/files What permission you recommended?

On Thu, 22 Jun 2017 at 20:16, Seth Pollack ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In addons/kubernetes-dashboard/v1.6.1.yaml <#2789 (comment)>: > + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + k8s-app: kubernetes-dashboard + k8s-addon: kubernetes-dashboard.addons.k8s.io + k8s-app: kubernetes-dashboard + name: kubernetes-dashboard + namespace: kube-system + +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding I don't think we want to just assume that the dashboard should have cluster-admin access. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2789 (review)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFbljJIJkKvpjZzIHrE02ic30Bl9TwS2ks5sGq-QgaJpZM4OBBCi> .

-- Giancarlo Rubio

[sethpollack]

Not sure, but that would give admin access to everyone with dashboard access. I don't think its a good idea to have that as the default. If anything the default should be no access.

@justinsb @liggitt any ideas?

[liggitt]

Not sure, but that would give admin access to everyone with dashboard access. I don't think its a good idea to have that as the default. If anything the default should be no access.

@justinsb @liggitt any ideas?

Correct, don't give the dashboard any permissions you don't want available to anyone with network visibility to pod or service IPs.

I don't know what role I would expect as the default. Does kops have any indication whether the user wants a secured cluster they can open up permissions on as they wish, or a dev cluster that is wide open by default?

[sethpollack]

Maybe don't bind to any role by default and let the user do that step manually.

[chrislovecnm]

@liggitt

I don't know what role I would expect as the default. Does kops have any indication whether the user wants a secured cluster they can open up permissions on as they wish, or a dev cluster that is wide open by default?

We do not have any expectation, other that a kops cluster is building a production grade cluster. We would like to lock it down, and allow a user to open the perms as needed. Just my two cents.

[chrislovecnm]

@liggitt / @sethpollack any further recommendations?

[sethpollack]

I would leave out the ClusterRoleBinding and add something to the readme about it.

[gianrubio]

I removed the cluster role binding, I just bumping the dashboard version and creating a service account.

[sethpollack]

lgtm, maybe just add something to the docs about the need to add your own role binding?

[gianrubio]

@sethpollack done, please review again!

[sethpollack]

👍

[chrislovecnm]

Thanks

[chrislovecnm]

/assign
/lgtm

[chrislovecnm]

merging per @sethpollack's review