Setting authorization mode to RBAC by default

[arschles]

Fixes #1722

Before this change, kubectl get clusterrole and kubectl get clusterrolebinding -- both indicators that RBAC auth is enabled in the cluster -- returned nothing. After this change, the ./out/minikube start command creates a cluster in which the following commands indicate that RBAC is turned on:

$ k get clusterrole
NAME                                           AGE
admin                                          4m
cluster-admin                                  4m
edit                                           4m
system:auth-delegator                          4m
system:basic-user                              4m
system:controller:attachdetach-controller      4m
system:controller:certificate-controller       4m
system:controller:cronjob-controller           4m
system:controller:daemon-set-controller        4m
system:controller:deployment-controller        4m
system:controller:disruption-controller        4m
system:controller:endpoint-controller          4m
system:controller:generic-garbage-collector    4m
system:controller:horizontal-pod-autoscaler    4m
system:controller:job-controller               4m
system:controller:namespace-controller         4m
system:controller:node-controller              4m
system:controller:persistent-volume-binder     4m
system:controller:pod-garbage-collector        4m
system:controller:replicaset-controller        4m
system:controller:replication-controller       4m
system:controller:resourcequota-controller     4m
system:controller:route-controller             4m
system:controller:service-account-controller   4m
system:controller:service-controller           4m
system:controller:statefulset-controller       4m
system:controller:ttl-controller               4m
system:discovery                               4m
system:heapster                                4m
system:kube-aggregator                         4m
system:kube-controller-manager                 4m
system:kube-dns                                4m
system:kube-scheduler                          4m
system:node                                    4m
system:node-bootstrapper                       4m
system:node-problem-detector                   4m
system:node-proxier                            4m
system:persistent-volume-provisioner           4m
view                                           4m
$ kubectl get clusterrolebinding
NAME                                           AGE
cluster-admin                                  6m
system:basic-user                              6m
system:controller:attachdetach-controller      6m
system:controller:certificate-controller       6m
system:controller:cronjob-controller           6m
system:controller:daemon-set-controller        6m
system:controller:deployment-controller        6m
system:controller:disruption-controller        6m
system:controller:endpoint-controller          6m
system:controller:generic-garbage-collector    6m
system:controller:horizontal-pod-autoscaler    6m
system:controller:job-controller               6m
system:controller:namespace-controller         6m
system:controller:node-controller              6m
system:controller:persistent-volume-binder     6m
system:controller:pod-garbage-collector        6m
system:controller:replicaset-controller        6m
system:controller:replication-controller       6m
system:controller:resourcequota-controller     6m
system:controller:route-controller             6m
system:controller:service-account-controller   6m
system:controller:service-controller           6m
system:controller:statefulset-controller       6m
system:controller:ttl-controller               6m
system:discovery                               6m
system:kube-controller-manager                 6m
system:kube-dns                                6m
system:kube-scheduler                          6m
system:node                                    6m
system:node-proxier                            6m

This patch would slightly improve the service-catalog installation process which currently has to instruct users to pass --extra-config=apiserver.Authorization.Mode=RBAC to minikube installations. If minikube turned on RBAC by default, we could remove the minikube-specific section altogether, and the first-time installation process would be smoother for minikube users.

[minikube-bot]

Can one of the admins verify this patch?

[dlorenc]

@minikube-bot OK to test

[r2d4]

I think this is going to need a few more changes to our addons and some service account permissions (e.g. the dashboard won't have enough permissions to query) . #1903 adds kubeadm as a cluster bootstrapper, which enables RBAC. I needed to add something like this https://github.com/r2d4/minikube/blob/93e9ba58b3936e353b1d5e0d1908989463693f21/pkg/minikube/bootstrapper/kubeadm/util.go#L84-L109 to make the dashboard usable out of the box.

[arschles]

thanks @r2d4 - I'll add perms elevation to accommodate the dashboard. do you know where I can look to see these addons?

[codecov-io]

Codecov Report

Merging #1904 into master will decrease coverage by 0.01%.
The diff coverage is 0%.

@@            Coverage Diff             @@
##           master    #1904      +/-   ##
==========================================
- Coverage   31.03%   31.01%   -0.02%     
==========================================
  Files          74       74              
  Lines        4302     4304       +2     
==========================================
  Hits         1335     1335              
- Misses       2792     2794       +2     
  Partials      175      175

Impacted Files	Coverage Δ
pkg/localkube/apiserver.go	0% <0%> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 81ec77a...42596c1. Read the comment docs.

[r2d4]

There are just the ones from https://github.com/kubernetes/minikube/tree/master/deploy/addons

[arschles]

got them, thanks @r2d4

[dlorenc]

Looks like there are some build failures:

pkg/minikube/bootstrapper/localkube/privileges.go:5: imported and not used: "k8s.io/minikube/vendor/k8s.io/apimachinery/pkg/api/errors" as apierrs
pkg/minikube/bootstrapper/localkube/privileges.go:7: imported and not used: "k8s.io/minikube/vendor/k8s.io/apimachinery/pkg/types"
pkg/minikube/bootstrapper/localkube/privileges.go:8: imported and not used: "k8s.io/minikube/vendor/k8s.io/apimachinery/pkg/util/strategicpatch"
pkg/minikube/bootstrapper/localkube/privileges.go:9: imported and not used: "k8s.io/minikube/vendor/k8s.io/client-go/pkg/api/v1" as clientv1

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[colinhoglund]

Correct me if i'm wrong, but I believe most RBAC-enabled clusters are not setup to give the kube-system:default service account cluster-admin privileges. Is it maybe safer to grant these privileges in the addons and services that need them, or perhaps create a new minikube-default service account to use in pods that would only exist in minikube?

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[kfox1111]

/remove-lifecycle rotten
/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[kenden]

/remove-lifecycle rotten

[minikube-bot]

Can one of the admins verify this patch?

[balopat]

@kenden Based on the discussion in #1722 it seems that RBAC is the default. Is this PR still required?

[tstromberg]

Closing because I think this PR is obsolete. Please re-open if this is incorrect.