Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce Control Plane's PSP and RBAC resources into Helm templates #2920

Merged
merged 4 commits into from
Jun 13, 2019
Merged

Introduce Control Plane's PSP and RBAC resources into Helm templates #2920

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
de1b9cf
Add control plane and CNI PSP and RBAC resources
Jun 11, 2019
4bb16de
Update unit test fixtures
Jun 11, 2019
5d7f6b8
Trigger l5d-bot
Jun 11, 2019
2ff22ff
Add the '--linkerd-cni-enabled' flag to the multi-stage install subco…
Jun 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 77 additions & 0 deletions chart/templates/psp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
{{with .Values -}}
---
###
### Control Plane PSP
###
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: linkerd-{{.Namespace}}-control-plane
spec:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
{{- if not .NoInitContainer }}
allowedCapabilities:
- NET_ADMIN
{{- end}}
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
runAsUser:
rule: RunAsAny
fsGroup:
rule: RunAsAny
volumes:
- configMap
- emptyDir
- secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: linkerd-psp
namespace: {{.Namespace}}
rules:
- apiGroups: ['policy', 'extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- linkerd-{{.Namespace}}-control-plane
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: linkerd-psp
namespace: {{.Namespace}}
roleRef:
kind: Role
name: linkerd-psp
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: linkerd-controller
namespace: {{.Namespace}}
- kind: ServiceAccount
name: linkerd-grafana
namespace: {{.Namespace}}
- kind: ServiceAccount
name: linkerd-identity
namespace: {{.Namespace}}
- kind: ServiceAccount
name: linkerd-prometheus
namespace: {{.Namespace}}
- kind: ServiceAccount
name: linkerd-proxy-injector
namespace: {{.Namespace}}
- kind: ServiceAccount
name: linkerd-sp-validator
namespace: {{.Namespace}}
- kind: ServiceAccount
name: linkerd-tap
namespace: {{.Namespace}}
- kind: ServiceAccount
name: linkerd-web
namespace: {{.Namespace}}
{{end -}}
19 changes: 13 additions & 6 deletions cli/cmd/install.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,7 @@ func newInstallIdentityOptionsWithDefaults() *installIdentityOptions {
}

// newCmdInstallConfig is a subcommand for `linkerd install config`
func newCmdInstallConfig(options *installOptions) *cobra.Command {
func newCmdInstallConfig(options *installOptions, parentFlags *pflag.FlagSet) *cobra.Command {
cmd := &cobra.Command{
Use: "config [flags]",
Args: cobra.NoArgs,
Expand All @@ -245,15 +245,18 @@ resources for the Linkerd control plane. This command should be followed by
# Install Linkerd into a non-default namespace.
linkerd install config -l linkerdtest | kubectl apply -f -`,
RunE: func(cmd *cobra.Command, args []string) error {
return installRunE(options, configStage, nil)
return installRunE(options, configStage, parentFlags)
},
}

cniEnabledFlag := parentFlags.Lookup("linkerd-cni-enabled")
cmd.Flags().AddFlag(cniEnabledFlag)

return cmd
}

// newCmdInstallControlPlane is a subcommand for `linkerd install control-plane`
func newCmdInstallControlPlane(options *installOptions) *cobra.Command {
func newCmdInstallControlPlane(options *installOptions, parentFlags *pflag.FlagSet) *cobra.Command {
// The base flags are recorded separately so that they can be serialized into
// the configuration in validateAndBuild.
flags := options.recordableFlagSet()
Expand Down Expand Up @@ -281,6 +284,9 @@ control plane. It should be run after "linkerd install config".`,
},
}

cniEnabledFlag := parentFlags.Lookup("linkerd-cni-enabled")
cmd.Flags().AddFlag(cniEnabledFlag)

cmd.PersistentFlags().BoolVar(
&options.skipChecks, "skip-checks", options.skipChecks,
`Skip checks for namespace existence`,
Expand Down Expand Up @@ -328,8 +334,8 @@ control plane.`,
cmd.Flags().AddFlagSet(installOnlyFlags)
cmd.PersistentFlags().AddFlagSet(installPersistentFlags)

cmd.AddCommand(newCmdInstallConfig(options))
cmd.AddCommand(newCmdInstallControlPlane(options))
cmd.AddCommand(newCmdInstallConfig(options, flags))
cmd.AddCommand(newCmdInstallControlPlane(options, flags))

return cmd
}
Expand Down Expand Up @@ -400,7 +406,7 @@ func (options *installOptions) recordableFlagSet() *pflag.FlagSet {
)

flags.BoolVar(&options.noInitContainer, "linkerd-cni-enabled", options.noInitContainer,
"Experimental: Omit the proxy-init container when injecting the proxy; requires the linkerd-cni plugin to already be installed",
"Experimental: Omit the NET_ADMIN capability in the PSP and the proxy-init container when injecting the proxy; requires the linkerd-cni plugin to already be installed",
)

flags.StringVar(
Expand Down Expand Up @@ -645,6 +651,7 @@ func (values *installValues) render(w io.Writer, configs *pb.All) error {
{Name: "templates/proxy_injector-rbac.yaml"},
{Name: "templates/sp_validator-rbac.yaml"},
{Name: "templates/tap-rbac.yaml"},
{Name: "templates/psp.yaml"},
}...)
}

Expand Down
45 changes: 45 additions & 0 deletions cli/cmd/testdata/install-cni-plugin_default.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,57 @@ apiVersion: v1
metadata:
name: linkerd
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: linkerd-linkerd-cni
spec:
allowPrivilegeEscalation: false
fsGroup:
rule: RunAsAny
hostNetwork: true
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- hostPath
- secret
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: linkerd-cni
namespace: linkerd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: linkerd-cni
namespace: linkerd
rules:
- apiGroups: ['extensions', 'policy']
resources: ['podsecuritypolicies']
resourceNames:
- linkerd-linkerd-cni
verbs: ['use']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: linkerd-cni
namespace: linkerd
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: linkerd-cni
subjects:
- kind: ServiceAccount
name: linkerd-cni
namespace: linkerd
---
# Include a clusterrole for the linkerd CNI DaemonSet,
# and bind it to the linkerd-cni serviceaccount.
kind: ClusterRole
Expand Down
45 changes: 45 additions & 0 deletions cli/cmd/testdata/install-cni-plugin_fully_configured.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,57 @@ apiVersion: v1
metadata:
name: other
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: linkerd-other-cni
spec:
allowPrivilegeEscalation: false
fsGroup:
rule: RunAsAny
hostNetwork: true
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- hostPath
- secret
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: linkerd-cni
namespace: other
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: linkerd-cni
namespace: other
rules:
- apiGroups: ['extensions', 'policy']
resources: ['podsecuritypolicies']
resourceNames:
- linkerd-other-cni
verbs: ['use']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: linkerd-cni
namespace: other
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: linkerd-cni
subjects:
- kind: ServiceAccount
name: linkerd-cni
namespace: other
---
# Include a clusterrole for the linkerd CNI DaemonSet,
# and bind it to the linkerd-cni serviceaccount.
kind: ClusterRole
Expand Down
45 changes: 45 additions & 0 deletions cli/cmd/testdata/install-cni-plugin_fully_configured_equal_dsts.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,57 @@ apiVersion: v1
metadata:
name: other
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: linkerd-other-cni
spec:
allowPrivilegeEscalation: false
fsGroup:
rule: RunAsAny
hostNetwork: true
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- hostPath
- secret
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: linkerd-cni
namespace: other
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: linkerd-cni
namespace: other
rules:
- apiGroups: ['extensions', 'policy']
resources: ['podsecuritypolicies']
resourceNames:
- linkerd-other-cni
verbs: ['use']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: linkerd-cni
namespace: other
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: linkerd-cni
subjects:
- kind: ServiceAccount
name: linkerd-cni
namespace: other
---
# Include a clusterrole for the linkerd CNI DaemonSet,
# and bind it to the linkerd-cni serviceaccount.
kind: ClusterRole
Expand Down
73 changes: 73 additions & 0 deletions cli/cmd/testdata/install_config.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -424,3 +424,76 @@ metadata:
name: linkerd-tap
namespace: linkerd
---
###
### Control Plane PSP
###
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: linkerd-linkerd-control-plane
spec:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
allowedCapabilities:
- NET_ADMIN
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
runAsUser:
rule: RunAsAny
fsGroup:
rule: RunAsAny
volumes:
- configMap
- emptyDir
- secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: linkerd-psp
namespace: linkerd
rules:
- apiGroups: ['policy', 'extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- linkerd-linkerd-control-plane
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: linkerd-psp
namespace: linkerd
roleRef:
kind: Role
name: linkerd-psp
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: linkerd-controller
namespace: linkerd
- kind: ServiceAccount
name: linkerd-grafana
namespace: linkerd
- kind: ServiceAccount
name: linkerd-identity
namespace: linkerd
- kind: ServiceAccount
name: linkerd-prometheus
namespace: linkerd
- kind: ServiceAccount
name: linkerd-proxy-injector
namespace: linkerd
- kind: ServiceAccount
name: linkerd-sp-validator
namespace: linkerd
- kind: ServiceAccount
name: linkerd-tap
namespace: linkerd
- kind: ServiceAccount
name: linkerd-web
namespace: linkerd
---
Loading