Allow ci-admins to crud prowjobs

[0xmichalis]

/cc @enj

[enj]

Does this need to be compatible with older clusters? If not, define the new role / bindings using RBAC instead of origin authz. Also, I believe @smarterclayton said he wanted ci-admins to be admins cluster wide. But maybe he wanted a different group with that power instead?

[stevekuznetsov]

?

[0xmichalis]

@enj is already in the ci-admins group in our cluster. I am not sure what's the scope of the group honestly. cc: @smarterclayton

[stevekuznetsov]

This group gives cluster level access to everything. I don't think Mo needs that.

[enj]

I was given access to help figure out some OAuth / RBAC issues. You are welcome to scope that down as you see fit.

[0xmichalis]

define the new role / bindings using RBAC instead of origin authz

Unclear what this means.. Do you mean that I should use the upstream types?

[stevekuznetsov]

wanted ci-admins to be admins cluster wide. But maybe he wanted a different group with that power instead?

@enj we have cluster-reader and sudoer which is sufficient. Giving access to e.g. oc delete is dangerous (lol)

[enj]

Unclear what this means.. Do you mean that I should use the upstream types?

Yes, there are the canonical representation in 3.7. The Origin authz resources are a proxy.

we have cluster-reader and sudoer which is sufficient. Giving access to e.g. oc delete is dangerous (lol)

That is fine, but it will fail the SAR check that Jenkins performs.

[stevekuznetsov]

We should have admin in the ci namespace from our GitHub team sync, that should take care of Jenkins

[0xmichalis]

Keeping just the cluster{role,rolebinding} for now. @smarterclayton where do I need to plumb this manifest so it is applied on cluster creation/upgrade?

[enj]

@Kargakis let the server do the conversion for you:

oc create -f prowjob_access.yaml
oc export clusterrolebinding.rbac.authorization.k8s.io/ci-admins-prowjobs clusterrole.rbac.authorization.k8s.io/prowjob-access -o yaml

apiVersion: v1
items:
- apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRoleBinding
  metadata:
    creationTimestamp: null
    name: ci-admins-prowjobs
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: prowjob-access
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: ci-admins
- apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRole
  metadata:
    creationTimestamp: null
    name: prowjob-access
  rules:
  - apiGroups:
    - prow.k8s.io
    resources:
    - prowjobs
    verbs:
    - create
    - delete
    - get
    - list
kind: List
metadata: {}

[0xmichalis]

@enj I am not as worried. There are other roles inside this repo that need to be converted, too, and I would prefer to handle them holistically.

[0xmichalis]

@smarterclayton we need to figure out how to apply this as part of the upgrade.

[0xmichalis]

or fresh installation

[smarterclayton]

Makefile in ci cluster was what i planned to run.

…

On Fri, Sep 29, 2017 at 11:07 PM, Michalis Kargakis < ***@***.***> wrote: or fresh installation — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#150 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_pxSmP5UCxkID_u6fq4_vbMUltx9xks5snbBwgaJpZM4PaGdT> .

[0xmichalis]

Added in #206