Skip to content

Commit

Permalink
rbac: Move to use private ServiceAccount (#435)
Browse files Browse the repository at this point in the history
Currently kubemacpool pods are using the default SA. Therefore extra
permissions are being granted to the default SA.
It would be better if they will use a dedicated SA.

Signed-off-by: Ram Lavi <[email protected]>
  • Loading branch information
RamLavi authored Sep 9, 2024
1 parent c1e70b8 commit 8ccff0e
Show file tree
Hide file tree
Showing 4 changed files with 27 additions and 3 deletions.
8 changes: 8 additions & 0 deletions config/default/manager/manager.yaml
Original file line number Diff line number Diff line change
@@ -1,4 +1,10 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: sa
namespace: system
---
apiVersion: v1
kind: Namespace
metadata:
labels:
Expand Down Expand Up @@ -45,6 +51,7 @@ spec:
annotations:
description: KubeMacPool manages MAC allocation to Pods and VMs
spec:
serviceAccountName: sa
tolerations:
- key: node.kubernetes.io/unreachable
operator: Exists
Expand Down Expand Up @@ -180,6 +187,7 @@ spec:
control-plane: cert-manager
controller-tools.k8s.io: "1.0"
spec:
serviceAccountName: sa
restartPolicy: Always
securityContext:
runAsNonRoot: true
Expand Down
2 changes: 1 addition & 1 deletion config/default/rbac/rbac_role_binding.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,5 @@ roleRef:
name: manager-role
subjects:
- kind: ServiceAccount
name: default
name: sa
namespace: system
10 changes: 9 additions & 1 deletion config/release/kubemacpool.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ metadata:
pod-security.kubernetes.io/enforce: restricted
name: kubemacpool-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubemacpool-sa
namespace: kubemacpool-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
Expand Down Expand Up @@ -95,7 +101,7 @@ roleRef:
name: kubemacpool-manager-role
subjects:
- kind: ServiceAccount
name: default
name: kubemacpool-sa
namespace: kubemacpool-system
---
apiVersion: v1
Expand Down Expand Up @@ -205,6 +211,7 @@ spec:
runAsUser: 107
seccompProfile:
type: RuntimeDefault
serviceAccountName: kubemacpool-sa
terminationGracePeriodSeconds: 5
---
apiVersion: apps/v1
Expand Down Expand Up @@ -329,6 +336,7 @@ spec:
runAsUser: 107
seccompProfile:
type: RuntimeDefault
serviceAccountName: kubemacpool-sa
terminationGracePeriodSeconds: 5
tolerations:
- effect: NoExecute
Expand Down
10 changes: 9 additions & 1 deletion config/test/kubemacpool.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,12 @@ metadata:
pod-security.kubernetes.io/enforce: restricted
name: kubemacpool-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubemacpool-sa
namespace: kubemacpool-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
Expand Down Expand Up @@ -96,7 +102,7 @@ roleRef:
name: kubemacpool-manager-role
subjects:
- kind: ServiceAccount
name: default
name: kubemacpool-sa
namespace: kubemacpool-system
---
apiVersion: v1
Expand Down Expand Up @@ -206,6 +212,7 @@ spec:
runAsUser: 107
seccompProfile:
type: RuntimeDefault
serviceAccountName: kubemacpool-sa
terminationGracePeriodSeconds: 5
---
apiVersion: apps/v1
Expand Down Expand Up @@ -330,6 +337,7 @@ spec:
runAsUser: 107
seccompProfile:
type: RuntimeDefault
serviceAccountName: kubemacpool-sa
terminationGracePeriodSeconds: 5
tolerations:
- effect: NoExecute
Expand Down

0 comments on commit 8ccff0e

Please sign in to comment.