Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Introduce Control Plane's PSP and RBAC resources into Helm templates #2920

Merged
merged 4 commits into from
Jun 13, 2019
Merged

Introduce Control Plane's PSP and RBAC resources into Helm templates #2920

merged 4 commits into from
Jun 13, 2019

Conversation

ihcsim
Copy link
Contributor

@ihcsim ihcsim commented Jun 11, 2019 •
edited
Loading

This PR updates linkerd install to always install the control plane's PSP and RBAC resources. These policies are only in-effect if the PSP admission controller is enabled. Only the Helm templates are changed.

Test cases:

bin/linkerd version --client
Client version: git-de1b9cf8

# expect linkerd-linkerd-control-plane PSP, linkerd-psp role and linkerd-psp role-binding
# to be created
bin/linkerd install| [less | kubectl apply -f - ]

# multi-stage install
# expect linkerd-linkerd-control-plane PSP, linkerd-psp role and linkerd-psp role-binding 
# to be created during config stage
bin/linkerd install config| [less | kubectl apply -f - ]
bin/linkerd install control-plane [less | kubectl apply -f - ]

# upgrade
linkerd version --client
Client version: edge-19.6.1

# expect linkerd-linkerd-control-plane PSP, linkerd-psp role and linkerd-psp role-binding
# to be created
bin/linkerd upgrade| [ less | kubectl apply -f - ]

# cni on GKE; nodes must be ubuntu since cos has read-only root filesystem
# expect linkerd-linkerd-cni PSP, linkerd-cni role and linkerd-cni role binding to be created
bin/linkerd install-cni --dest-cni-bin-dir=/home/kubernetes/bin|k apply -f -

# expect linkerd-linkerd-control-plane PSP, linkerd-psp role and linkerd-psp role-binding 
# to be created
bin/linkerd install --linkerd-cni-enabled | [ less | kubectl apply -f -]

# cni with multi-stage install on GKE
# expect linkerd-linkerd-control-plane PSP to be created w/o NET_ADMIN capability
bin/linkerd install config --linkerd-cni-enabled| kubectl apply -f -

# expect control plane components to be installed with proxy-init init containers
bin/linkerd install control-plane --linkerd-cni-enabled| kubectl apply -f -

Signed-off-by: Ivan Sim [email protected]

Fixes #2892

@ihcsim ihcsim requested review from olix0r and alpeb June 11, 2019 17:08
@ihcsim ihcsim self-assigned this Jun 11, 2019
grampelberg
grampelberg reviewed Jun 11, 2019
View reviewed changes
Copy link
Contributor

@grampelberg grampelberg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like it, this is a great PSP.

cli/install/cni-template.go Show resolved Hide resolved
alpeb
alpeb approved these changes Jun 11, 2019
View reviewed changes
Copy link
Member

@alpeb alpeb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, modulo l5d-bot giving his opinion 👍

@alpeb alpeb mentioned this pull request Jun 11, 2019
Closed
@l5d-bot
Copy link
Collaborator

l5d-bot commented Jun 11, 2019

Integration test results for b4c188f: fail 😕
Log output: https://gist.github.com/73062f5a56beca3f7a67cac7be668973

@ihcsim
Copy link
Contributor Author

ihcsim commented Jun 11, 2019

Integration test results for b4c188f: fail

The pr-listener RBAC needs to be updated so that it can work with the podsecuritypolicies resources. I think I know where the YAMLs are.

@ihcsim ihcsim force-pushed the isim/control-plane-psp branch 4 times, most recently from cc2e48b to 841c442 Compare June 11, 2019 23:15
@l5d-bot
Copy link
Collaborator

l5d-bot commented Jun 11, 2019

Integration test results for 841c442: fail 😕
Log output: https://gist.github.com/98459d0bfa9a1295715a584be9502e32

@ihcsim ihcsim force-pushed the isim/control-plane-psp branch 6 times, most recently from 2064f57 to 994e420 Compare June 12, 2019 04:36
@l5d-bot
Copy link
Collaborator

l5d-bot commented Jun 12, 2019

Integration test results for 994e420: fail 😕
Log output: https://gist.github.com/89de8e8d630e978f9a30afe344be1f2e

@ihcsim ihcsim force-pushed the isim/control-plane-psp branch from 994e420 to 95e447f Compare June 12, 2019 04:54
@l5d-bot
Copy link
Collaborator

l5d-bot commented Jun 12, 2019

Integration test results for 95e447f: success 🎉
Log output: https://gist.github.com/f633335eeaccc0c33ee2f1c880a5f8a8

Trigger l5d-bot
5d7f6b8 
Signed-off-by: Ivan Sim <[email protected]>
@ihcsim ihcsim force-pushed the isim/control-plane-psp branch from 95e447f to 5d7f6b8 Compare June 12, 2019 05:18
@l5d-bot
Copy link
Collaborator

l5d-bot commented Jun 12, 2019

Integration test results for 5d7f6b8: success 🎉
Log output: https://gist.github.com/f6df354a9051a5ea0edcea99ba53e9df

Add the '--linkerd-cni-enabled' flag to the multi-stage install subco…
2ff22ff 
…mmands

This flag ensures that the NET_ADMIN capability is omitted from the control
plane's PSP during 'install config' and the proxy-init containers aren't
injected during 'install control-plane'.

Signed-off-by: Ivan Sim <[email protected]>
@l5d-bot
Copy link
Collaborator

l5d-bot commented Jun 12, 2019

Integration test results for 2ff22ff: success 🎉
Log output: https://gist.github.com/2588f9aeef3cfa3e8e4bf32c63d7600a

@ihcsim ihcsim merged commit ecc4465 into master Jun 13, 2019
@ihcsim ihcsim deleted the isim/control-plane-psp branch June 13, 2019 03:18
siggy added a commit that referenced this pull request Jun 18, 2019
@siggy
Remove NET_ADMIN check, introduce PSP check
536be20 
The change in #2920 introduced a PodSecurityPolicy, providing
`NET_ADMIN` capability to Linkerd. This eliminated the need for a
`NET_ADMIN` capability check in `linkerd check`, as the default
`linkerd install` now guarantees `NET_ADMIN` capability. At the same
time, this added a requirement on that `linkerd install` create a
PodSecurityPolicy.

Remove the `NET_ADMIN` capability check from `linkerd check`. Introduce
a check to validate the user can create a PodSecurityPolicy.

Fixes #2884, #2849.

Signed-off-by: Andrew Seigner <[email protected]>
siggy added a commit that referenced this pull request Jun 18, 2019
@siggy
Remove NET_ADMIN check, introduce PSP check
6818865 
The change in #2920 introduced a PodSecurityPolicy, providing
`NET_ADMIN` capability to Linkerd. This eliminated the need for a
`NET_ADMIN` capability check in `linkerd check`, as the default
`linkerd install` now guarantees `NET_ADMIN` capability. At the same
time, this added a requirement that `linkerd install` create a
PodSecurityPolicy.

Remove the `NET_ADMIN` capability check from `linkerd check`. Introduce
a check to validate the user can create a PodSecurityPolicy.

Fixes #2884, #2849.

Signed-off-by: Andrew Seigner <[email protected]>
siggy added a commit that referenced this pull request Jun 18, 2019
@siggy
Remove NET_ADMIN check, introduce PSP check
4065ab8 
The change in #2920 introduced a PodSecurityPolicy, providing
`NET_ADMIN` capability to Linkerd. This eliminated the need for a
`NET_ADMIN` capability check in `linkerd check`, as the default
`linkerd install` now guarantees `NET_ADMIN` capability. At the same
time, this added a requirement that `linkerd install` create a
PodSecurityPolicy.

Remove the `NET_ADMIN` capability check from `linkerd check`. Introduce
a check to validate the user can create a PodSecurityPolicy.

Fixes #2884, #2849.

Signed-off-by: Andrew Seigner <[email protected]>
@siggy siggy mentioned this pull request Jun 18, 2019
Merged
siggy added a commit that referenced this pull request Jun 18, 2019
@siggy
Remove NET_ADMIN check, introduce PSP check
d30e90d 
The change in #2920 introduced a PodSecurityPolicy, providing
`NET_ADMIN` capability to Linkerd. This eliminated the need for a
`NET_ADMIN` capability check in `linkerd check`, as the default
`linkerd install` now guarantees `NET_ADMIN` capability. At the same
time, this added a requirement that `linkerd install` create a
PodSecurityPolicy.

Remove the `NET_ADMIN` capability check from `linkerd check`. Introduce
a check to validate the user can create a PodSecurityPolicy.

Fixes #2884, #2849

Signed-off-by: Andrew Seigner <[email protected]>
siggy added a commit that referenced this pull request Jun 19, 2019
@siggy
Make NET_ADMIN check a warning, add PSP check
19407e9 
`linkerd check` validates whether PSP's exist, and if the caller has the
`NET_ADMIN` capability. This check was previously failing if `NET_ADMIN`
was not found, even in the case where the PSP admission controller was
not running. Related, `linkerd install` now includes a PSP, so
`linkerd check` should also validate that the caller can create PSP's.

Modify the `NET_ADMIN` check to warn, but not fail, if PSP's are found
but the caller does not have `NET_ADMIN`. Update the warning message to
mention that this is only a problem if the PSP admission controller is
running (and will only be a problem during injection, since #2920
handles control plane installation by adding its own PSP).

Also introduce a check to validate the caller can create PSP's.

Fixes #2884, #2849

Signed-off-by: Andrew Seigner <[email protected]>
siggy added a commit that referenced this pull request Jun 20, 2019
@siggy
Make NET_ADMIN check a warning, add PSP check (#2958)
2528e3d 
`linkerd check` validates whether PSP's exist, and if the caller has the
`NET_ADMIN` capability. This check was previously failing if `NET_ADMIN`
was not found, even in the case where the PSP admission controller was
not running. Related, `linkerd install` now includes a PSP, so
`linkerd check` should also validate that the caller can create PSP's.

Modify the `NET_ADMIN` check to warn, but not fail, if PSP's are found
but the caller does not have `NET_ADMIN`. Update the warning message to
mention that this is only a problem if the PSP admission controller is
running (and will only be a problem during injection, since #2920
handles control plane installation by adding its own PSP).

Also introduce a check to validate the caller can create PSP's.

Fixes #2884, #2849

Signed-off-by: Andrew Seigner <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@grampelberg grampelberg grampelberg left review comments

@alpeb alpeb alpeb approved these changes

@olix0r olix0r Awaiting requested review from olix0r

Assignees

@ihcsim ihcsim

Labels
area/controller priority/P0 Release Blocker
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

New PSP and RBAC resources for the control plane
4 participants
@ihcsim @l5d-bot @grampelberg @alpeb