Skip to content

Commit 98ac477

Browse files
mfanjiemfanjie
authored
Merge pull request #875 from Cloudzp/convergence_rbac_permissions
optimize craned rbac config
2 parents e29f4d6 + 3ae52c6 commit 98ac477

1 file changed

Lines changed: 113 additions & 7 deletions

File tree

‎deploy/craned/rbac.yaml‎

Lines changed: 113 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,119 @@
11
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: craned
5+
namespace: crane-system
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- configmaps
11+
- secrets
12+
verbs:
13+
- create
14+
- apiGroups:
15+
- ""
16+
resourceNames:
17+
- craned
18+
resources:
19+
- configmaps
20+
verbs:
21+
- get
22+
- patch
23+
- update
24+
- apiGroups:
25+
- ""
26+
resourceNames:
27+
- clusters-secret-store
28+
resources:
29+
- secrets
30+
verbs:
31+
- get
32+
- apiGroups:
33+
- coordination.k8s.io
34+
resources:
35+
- leases
36+
verbs:
37+
- get
38+
- patch
39+
- update
40+
- create
41+
---
42+
apiVersion: rbac.authorization.k8s.io/v1
243
kind: ClusterRole
344
metadata:
445
name: craned
546
rules:
6-
- apiGroups: [ '*' ]
7-
resources: [ '*' ]
8-
verbs: [ "*" ]
47+
- apiGroups:
48+
- ""
49+
resources:
50+
- configmaps
51+
- pods
52+
- nodes
53+
verbs:
54+
- get
55+
- list
56+
- watch
57+
- apiGroups:
58+
- analysis.crane.io
59+
resources:
60+
- "*"
61+
verbs:
62+
- "*"
63+
- apiGroups:
64+
- apps
65+
resources:
66+
- daemonsets
67+
- deployments
68+
- deployments/scale
69+
- statefulsets
70+
- statefulsets/scale
71+
verbs:
72+
- get
73+
- list
74+
- watch
75+
- update
76+
- apiGroups:
77+
- autoscaling
78+
resources:
79+
- horizontalpodautoscalers
80+
verbs:
81+
- '*'
82+
- apiGroups:
83+
- autoscaling.crane.io
84+
resources:
85+
- '*'
86+
verbs:
87+
- '*'
88+
- apiGroups:
89+
- ""
90+
resources:
91+
- events
92+
verbs:
93+
- create
94+
- patch
95+
- update
96+
- apiGroups:
97+
- prediction.crane.io
98+
resources:
99+
- '*'
100+
verbs:
101+
- '*'
102+
---
103+
apiVersion: rbac.authorization.k8s.io/v1
104+
kind: RoleBinding
105+
metadata:
106+
name: craned
107+
namespace: crane-system
108+
roleRef:
109+
apiGroup: rbac.authorization.k8s.io
110+
kind: Role
111+
name: craned
112+
subjects:
113+
- kind: ServiceAccount
114+
name: craned
115+
namespace: crane-system
9116
---
10-
11117
apiVersion: rbac.authorization.k8s.io/v1
12118
kind: ClusterRoleBinding
13119
metadata:
@@ -17,6 +123,6 @@ roleRef:
17123
kind: ClusterRole
18124
name: craned
19125
subjects:
20-
- kind: ServiceAccount
21-
name: craned
22-
namespace: crane-system
126+
- kind: ServiceAccount
127+
name: craned
128+
namespace: crane-system

0 commit comments

Comments
 (0)