Skip to content

Commit 736157a

Browse files
dcbergrshriram
dcberg
authored and
rshriram
committed
Updated v1alpha to use fine grain RBAC rules (#272)
* Updated v1alpha to use fine grain RBAC rules * updated alpha rbac to add update support to istio-ca * Improve rbac for istio-ca and istio-manager
1 parent 7eef7a6 commit 736157a

File tree

1 file changed

+103
-5
lines changed

1 file changed

+103
-5
lines changed

‎install/kubernetes/istio-rbac-alpha.yaml‎

Lines changed: 103 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,112 @@
11
# Permissions and roles for istio
2+
# To debug: start the cluster with -vmodule=rbac,3 to enable verbose logging on RBAC DENY
3+
# Also helps to enable logging on apiserver 'wrap' to see the URLs.
4+
# Each RBAC deny needs to be mapped into a rule for the role.
5+
# If using minikube, start with '--extra-config=apiserver.Authorization.Mode=RBAC'
6+
#
7+
# NOTE: If deploying istio to a namespace other than 'default' then change the
8+
# ClusterRoleBinding namspace target appropriately.
9+
kind: ClusterRole
210
apiVersion: rbac.authorization.k8s.io/v1alpha1
3-
kind: RoleBinding
411
metadata:
5-
name: istio-binding
12+
name: istio-manager
13+
rules:
14+
- apiGroups: ["istio.io"]
15+
resources: ["istioconfigs", "istioconfigs.istio.io"]
16+
verbs: ["*"]
17+
- apiGroups: ["extensions"]
18+
resources: ["thirdpartyresources", "thirdpartyresources.extensions", "ingresses"]
19+
verbs: ["*"]
20+
- apiGroups: [""]
21+
resources: ["configmaps", "endpoints", "pods", "services"]
22+
verbs: ["*"]
23+
- apiGroups: [""]
24+
resources: ["namespaces"]
25+
verbs: ["get", "list"]
26+
---
27+
kind: ClusterRole
28+
apiVersion: rbac.authorization.k8s.io/v1alpha1
29+
metadata:
30+
name: istio-ca
31+
rules:
32+
- apiGroups: [""]
33+
resources: ["secrets"]
34+
verbs: ["create", "get", "watch", "list", "update"]
35+
- apiGroups: [""]
36+
resources: ["serviceaccounts"]
37+
verbs: ["watch", "list"]
38+
---
39+
# Permissions for the sidecar proxy.
40+
kind: ClusterRole
41+
apiVersion: rbac.authorization.k8s.io/v1alpha1
42+
metadata:
43+
name: istio-sidecar
44+
rules:
45+
- apiGroups: ["istio.io"]
46+
resources: ["istioconfigs"]
47+
verbs: ["get", "watch", "list"]
48+
- apiGroups: ["extensions"]
49+
resources: ["thirdpartyresources"]
50+
verbs: ["get", "watch", "list"]
51+
- apiGroups: [""]
52+
resources: ["configmaps", "pods", "endpoints", "services"]
53+
verbs: ["get", "watch", "list"]
54+
---
55+
# Grant permissions to the Manager/discovery.
56+
kind: ClusterRoleBinding
57+
apiVersion: rbac.authorization.k8s.io/v1alpha1
58+
metadata:
59+
name: istio-manager-admin-role-binding
60+
subjects:
61+
- kind: ServiceAccount
62+
name: istio-manager-service-account
63+
namespace: default
664
roleRef:
7-
apiGroup: rbac.authorization.k8s.io
865
kind: ClusterRole
9-
name: admin-role-resourceURLSs
66+
name: istio-manager
67+
apiGroup: rbac.authorization.k8s.io
68+
---
69+
# Grant permissions to the Manager/discovery.
70+
kind: ClusterRoleBinding
71+
apiVersion: rbac.authorization.k8s.io/v1alpha1
72+
metadata:
73+
name: istio-ca-role-binding
1074
subjects:
1175
- kind: ServiceAccount
12-
name: istio-manager-service-account
76+
name: istio-ca-service-account
77+
namespace: default
78+
roleRef:
79+
kind: ClusterRole
80+
name: istio-ca
81+
apiGroup: rbac.authorization.k8s.io
82+
---
83+
# Grant permissions to the Ingress controller.
84+
kind: ClusterRoleBinding
85+
apiVersion: rbac.authorization.k8s.io/v1alpha1
86+
metadata:
87+
name: istio-ingress-admin-role-binding
88+
subjects:
1389
- kind: ServiceAccount
1490
name: istio-ingress-service-account
91+
namespace: default
92+
roleRef:
93+
kind: ClusterRole
94+
name: istio-manager
95+
apiGroup: rbac.authorization.k8s.io
96+
---
97+
# Grant permissions to the sidecar.
98+
# TEMPORARY: the istioctl should generate a separate service account for the proxy, and permission
99+
# granted only to that account !
100+
kind: ClusterRoleBinding
101+
apiVersion: rbac.authorization.k8s.io/v1alpha1
102+
metadata:
103+
name: istio-sidecar-role-binding
104+
subjects:
105+
- kind: ServiceAccount
106+
name: default
107+
namespace: default
108+
roleRef:
109+
kind: ClusterRole
110+
name: istio-sidecar
111+
apiGroup: rbac.authorization.k8s.io
112+
---

0 commit comments

Comments
 (0)