advanced router role

[rajatchopra]

Follow up to #11528

[deads2k]

I think you only need this one. A user can have multiple roles, so this is what you need in addition to the existing router role.

[deads2k]

How many router flavors do we have? Seems like we might want to name this specifically for F5, so that if you need to "list privileged-fobbers" next, we don't need any new bindings.

[rajatchopra]

@deads2k @smarterclayton PTAL. Will get the docs PR rolling meanwhile.

cc @knobunc

[liggitt]

Would the existing system:sdn-reader role make more sense for something that wanted to participate in SDN stuff? It grants read access to more than just nodes, but that doesn't really bother me if the semantics match ("something that needs read-only access to SDN information"), and it seems like a generic "SDN aware router" role would eventually converge on the SDN reader role anyway

[knobunc]

I agree with @liggitt. This is what I was trying to get at yesterday afternoon on IRC before my PC crashed. I was trying to work out if it was better to grant two roles to the F5 router, than make one super-role. Personally, I like the two because it makes it clear that the F5 has extra privs.

[liggitt]

+1 for granting system:router (for router-related perms) and system:sdn-reader (for SDN-related perms)

[deads2k]

I agree with @liggitt. This is what I was trying to get at yesterday afternoon on IRC before my PC crashed. I was trying to work out if it was better to grant two roles to the F5 router, than make one super-role. Personally, I like the two because it makes it clear that the F5 has extra privs.

I think we've all agreed on two, we're just deciding if system:sdn-reader is the same as system:sdn-integrated-router. I would have assumed their different, but I don't have much knowledge in the domain.

[deads2k]

I think we've all agreed on two, we're just deciding if system:sdn-reader is the same as system:sdn-integrated-router. I would have assumed their different, but I don't have much knowledge in the domain

To elaborate, I can envision a router that may want to mutate some resource. I'm hard pressed to come up with a use-case for a "reader" role having mutation privileges.

[liggitt]

To elaborate, I can envision a router that may want to mutate some resource. I'm hard pressed to come up with a use-case for a "reader" role having mutation privileges.

Sure... we wouldn't add write permissions to the reader role. I don't know enough about how the SDN objects interact to know if subdividing write access to just some of them is valuable, or if we had a router that needed SDN write permissions, we would just grant the system:sdn-manager role to it.

[rajatchopra]

I am tempted to kill this one and just use SDNReaderRoleName that already exists. The only thing extra over there is the egressnetworkpolicies, harmless to read I think.

[rajatchopra]

This is what will go in for the docs then (we do not need another role here):
oadm policy add-cluster-role-to-user system:sdn-reader system:serviceaccount:default:router