Skip to content

Commit 371c5ab

Browse files
blumamirblumamir
authored
chore: narrow down the rbac permissions for schedualer (#2024)
In this PR: - move destinations and collectorsgroup rbac permission to be role (on odigos ns) instead of clusterrole. These live anyway only in our ns, but it looks better in rbac reviews. - removed unused create/delete/update/patch for the destinations, as we only read them. - currently the leader election role brings in configmaps permissions, but I also added the permissions we need for the reconcilers so not to mix unrelated things. we will need to also understand and address the leader election role later on. - removed the finalizers permissions, as we don't use finalizers and it's unused. - created some consts in cli files for better structure to the references - synced helm files with the changes - tested both helm and cli locally to make sure it works InstrumentationConfig is left as a clusterrole, since they belong to the various namespaces where the sources reside.
1 parent c6ff525 commit 371c5ab

File tree

5 files changed

+145
-69
lines changed

5 files changed

+145
-69
lines changed

‎cli/cmd/resources/scheduler.go

+75-38
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"github.com/odigos-io/odigos/cli/pkg/containers"
88
"github.com/odigos-io/odigos/cli/pkg/kube"
99
"github.com/odigos-io/odigos/common"
10+
"github.com/odigos-io/odigos/common/consts"
1011

1112
appsv1 "k8s.io/api/apps/v1"
1213
corev1 "k8s.io/api/core/v1"
@@ -17,11 +18,16 @@ import (
1718
)
1819

1920
const (
20-
SchedulerImage = "keyval/odigos-scheduler"
21-
SchedulerServiceName = "scheduler"
22-
SchedulerDeploymentName = "odigos-scheduler"
23-
SchedulerAppLabelValue = "odigos-scheduler"
24-
SchedulerContainerName = "manager"
21+
SchedulerImage = "keyval/odigos-scheduler"
22+
SchedulerServiceName = "scheduler"
23+
SchedulerDeploymentName = "odigos-scheduler"
24+
SchedulerAppLabelValue = SchedulerDeploymentName
25+
SchedulerRoleName = SchedulerDeploymentName
26+
SchedulerRoleBindingName = SchedulerDeploymentName
27+
SchedulerClusterRoleName = SchedulerDeploymentName
28+
SchedulerClusterRoleBindingName = SchedulerDeploymentName
29+
SchedulerServiceAccountName = SchedulerDeploymentName
30+
SchedulerContainerName = "manager"
2531
)
2632

2733
func NewSchedulerServiceAccount(ns string) *corev1.ServiceAccount {
@@ -31,13 +37,13 @@ func NewSchedulerServiceAccount(ns string) *corev1.ServiceAccount {
3137
APIVersion: "v1",
3238
},
3339
ObjectMeta: metav1.ObjectMeta{
34-
Name: "odigos-scheduler",
40+
Name: SchedulerServiceAccountName,
3541
Namespace: ns,
3642
},
3743
}
3844
}
3945

40-
func NewSchedulerRoleBinding(ns string) *rbacv1.RoleBinding {
46+
func NewSchedulerLeaderElectionRoleBinding(ns string) *rbacv1.RoleBinding {
4147
return &rbacv1.RoleBinding{
4248
TypeMeta: metav1.TypeMeta{
4349
Kind: "RoleBinding",
@@ -50,7 +56,7 @@ func NewSchedulerRoleBinding(ns string) *rbacv1.RoleBinding {
5056
Subjects: []rbacv1.Subject{
5157
{
5258
Kind: "ServiceAccount",
53-
Name: "odigos-scheduler",
59+
Name: SchedulerServiceAccountName,
5460
},
5561
},
5662
RoleRef: rbacv1.RoleRef{
@@ -61,42 +67,48 @@ func NewSchedulerRoleBinding(ns string) *rbacv1.RoleBinding {
6167
}
6268
}
6369

64-
func NewSchedulerClusterRole() *rbacv1.ClusterRole {
65-
return &rbacv1.ClusterRole{
70+
func NewSchedulerRole(ns string) *rbacv1.Role {
71+
return &rbacv1.Role{
6672
TypeMeta: metav1.TypeMeta{
67-
Kind: "ClusterRole",
73+
Kind: "Role",
6874
APIVersion: "rbac.authorization.k8s.io/v1",
6975
},
7076
ObjectMeta: metav1.ObjectMeta{
71-
Name: "odigos-scheduler",
77+
Name: SchedulerRoleName,
78+
Namespace: ns,
7279
},
7380
Rules: []rbacv1.PolicyRule{
7481
{
7582
Verbs: []string{
76-
"create",
77-
"delete",
7883
"get",
7984
"list",
80-
"patch",
81-
"update",
8285
"watch",
8386
},
8487
APIGroups: []string{
85-
"odigos.io",
88+
"",
8689
},
8790
Resources: []string{
88-
"collectorsgroups",
91+
"configmaps",
92+
},
93+
ResourceNames: []string{
94+
consts.OdigosConfigurationName,
8995
},
9096
},
9197
{
9298
Verbs: []string{
99+
"create",
100+
"delete",
101+
"get",
102+
"list",
103+
"patch",
93104
"update",
105+
"watch",
94106
},
95107
APIGroups: []string{
96108
"odigos.io",
97109
},
98110
Resources: []string{
99-
"collectorsgroups/finalizers",
111+
"collectorsgroups",
100112
},
101113
},
102114
{
@@ -114,12 +126,8 @@ func NewSchedulerClusterRole() *rbacv1.ClusterRole {
114126
},
115127
{
116128
Verbs: []string{
117-
"create",
118-
"delete",
119129
"get",
120130
"list",
121-
"patch",
122-
"update",
123131
"watch",
124132
},
125133
APIGroups: []string{
@@ -129,17 +137,6 @@ func NewSchedulerClusterRole() *rbacv1.ClusterRole {
129137
"destinations",
130138
},
131139
},
132-
{
133-
Verbs: []string{
134-
"update",
135-
},
136-
APIGroups: []string{
137-
"odigos.io",
138-
},
139-
Resources: []string{
140-
"destinations/finalizers",
141-
},
142-
},
143140
{
144141
Verbs: []string{
145142
"get",
@@ -153,6 +150,44 @@ func NewSchedulerClusterRole() *rbacv1.ClusterRole {
153150
"destinations/status",
154151
},
155152
},
153+
},
154+
}
155+
}
156+
157+
func NewSchedulerRoleBinding(ns string) *rbacv1.RoleBinding {
158+
return &rbacv1.RoleBinding{
159+
TypeMeta: metav1.TypeMeta{
160+
Kind: "RoleBinding",
161+
APIVersion: "rbac.authorization.k8s.io/v1",
162+
},
163+
ObjectMeta: metav1.ObjectMeta{
164+
Name: SchedulerRoleBindingName,
165+
Namespace: ns,
166+
},
167+
Subjects: []rbacv1.Subject{
168+
{
169+
Kind: "ServiceAccount",
170+
Name: SchedulerServiceAccountName,
171+
},
172+
},
173+
RoleRef: rbacv1.RoleRef{
174+
APIGroup: "rbac.authorization.k8s.io",
175+
Kind: "Role",
176+
Name: SchedulerRoleName,
177+
},
178+
}
179+
}
180+
181+
func NewSchedulerClusterRole() *rbacv1.ClusterRole {
182+
return &rbacv1.ClusterRole{
183+
TypeMeta: metav1.TypeMeta{
184+
Kind: "ClusterRole",
185+
APIVersion: "rbac.authorization.k8s.io/v1",
186+
},
187+
ObjectMeta: metav1.ObjectMeta{
188+
Name: SchedulerClusterRoleName,
189+
},
190+
Rules: []rbacv1.PolicyRule{
156191
{
157192
Verbs: []string{
158193
"list",
@@ -173,19 +208,19 @@ func NewSchedulerClusterRoleBinding(ns string) *rbacv1.ClusterRoleBinding {
173208
APIVersion: "rbac.authorization.k8s.io/v1",
174209
},
175210
ObjectMeta: metav1.ObjectMeta{
176-
Name: "odigos-scheduler",
211+
Name: SchedulerClusterRoleBindingName,
177212
},
178213
Subjects: []rbacv1.Subject{
179214
{
180215
Kind: "ServiceAccount",
181-
Name: "odigos-scheduler",
216+
Name: SchedulerServiceAccountName,
182217
Namespace: ns,
183218
},
184219
},
185220
RoleRef: rbacv1.RoleRef{
186221
APIGroup: "rbac.authorization.k8s.io",
187222
Kind: "ClusterRole",
188-
Name: "odigos-scheduler",
223+
Name: SchedulerClusterRoleName,
189224
},
190225
}
191226
}
@@ -285,7 +320,7 @@ func NewSchedulerDeployment(ns string, version string, imagePrefix string) *apps
285320
},
286321
},
287322
TerminationGracePeriodSeconds: ptrint64(10),
288-
ServiceAccountName: "odigos-scheduler",
323+
ServiceAccountName: SchedulerServiceAccountName,
289324
SecurityContext: &corev1.PodSecurityContext{
290325
RunAsNonRoot: ptrbool(true),
291326
},
@@ -313,6 +348,8 @@ func (a *schedulerResourceManager) Name() string { return "Scheduler" }
313348
func (a *schedulerResourceManager) InstallFromScratch(ctx context.Context) error {
314349
resources := []kube.Object{
315350
NewSchedulerServiceAccount(a.ns),
351+
NewSchedulerLeaderElectionRoleBinding(a.ns),
352+
NewSchedulerRole(a.ns),
316353
NewSchedulerRoleBinding(a.ns),
317354
NewSchedulerClusterRole(),
318355
NewSchedulerClusterRoleBinding(a.ns),

‎helm/odigos/templates/scheduler/clusterrole.yaml

+2-31
Original file line numberDiff line numberDiff line change
@@ -3,40 +3,11 @@ kind: ClusterRole
33
metadata:
44
name: odigos-scheduler
55
rules:
6-
- apiGroups:
7-
- odigos.io
8-
resources:
9-
- collectorsgroups
10-
- destinations
11-
verbs:
12-
- create
13-
- delete
14-
- get
15-
- list
16-
- patch
17-
- update
18-
- watch
19-
- apiGroups:
20-
- odigos.io
21-
resources:
22-
- collectorsgroups/finalizers
23-
- destinations/finalizers
24-
verbs:
25-
- update
26-
- apiGroups:
27-
- odigos.io
28-
resources:
29-
- collectorsgroups/status
30-
- destinations/status
31-
verbs:
32-
- get
33-
- patch
34-
- update
356
- apiGroups:
367
- odigos.io
378
resources:
389
- instrumentationconfigs
3910
verbs:
40-
- get
4111
- list
42-
- watch
12+
- get
13+
- watch

‎helm/odigos/templates/scheduler/role-binding.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: odigos-scheduler
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: Role
8+
name: odigos-scheduler
9+
subjects:
10+
- kind: ServiceAccount
11+
name: odigos-scheduler

‎helm/odigos/templates/scheduler/role.yaml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: odigos-scheduler
5+
rules:
6+
- apiGroups:
7+
- ""
8+
resourceNames:
9+
- odigos-config
10+
resources:
11+
- configmaps
12+
verbs:
13+
- get
14+
- list
15+
- watch
16+
- apiGroups:
17+
- odigos.io
18+
resources:
19+
- collectorsgroups
20+
verbs:
21+
- create
22+
- delete
23+
- get
24+
- list
25+
- patch
26+
- update
27+
- watch
28+
- apiGroups:
29+
- odigos.io
30+
resources:
31+
- collectorsgroups/status
32+
verbs:
33+
- get
34+
- patch
35+
- update
36+
- apiGroups:
37+
- odigos.io
38+
resources:
39+
- destinations
40+
verbs:
41+
- get
42+
- list
43+
- watch
44+
- apiGroups:
45+
- odigos.io
46+
resources:
47+
- destinations/status
48+
verbs:
49+
- get
50+
- patch
51+
- update

‎scheduler/main.go

+6
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,12 @@ func main() {
9494
&corev1.ConfigMap{}: {
9595
Field: odigosConfigSelector,
9696
},
97+
&odigosv1.CollectorsGroup{}: {
98+
Field: nsSelector,
99+
},
100+
&odigosv1.Destination{}: {
101+
Field: nsSelector,
102+
},
97103
},
98104
},
99105
HealthProbeBindAddress: probeAddr,

0 commit comments

Comments
 (0)