karmada-io
/
karmada
mirror of https://github.com/karmada-io/karmada.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2357 from lonelyCZ/pr-join-pull-rbac 

Set the required RBAC to enable the certificate signing request
This commit is contained in:
karmada-bot 2022-08-22 17:09:49 +08:00 committed by GitHub
parent c10e5f6863 59c17d911f
commit cc74041e7f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 177 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
pkg/karmadactl/cmdinit/bootstraptoken/agent/tlsbootstrap.go Normal file
View File

@ -0,0 +1,70 @@
package agent
import (
rbacv1 "k8s.io/api/rbac/v1"
"k8s.io/client-go/kubernetes"
"k8s.io/klog/v2"
"github.com/karmada-io/karmada/pkg/karmadactl/cmdinit/utils"
)
const (
// KarmadaAgentBootstrapperClusterRoleName defines the name of the auto-bootstrapped ClusterRole for letting someone post a CSR
KarmadaAgentBootstrapperClusterRoleName = "system:node-bootstrapper"
// KarmadaAgentBootstrap defines the name of the ClusterRoleBinding that lets Karmada Agent post CSRs
KarmadaAgentBootstrap = "karmada:agent-bootstrap"
// KarmadaAgentGroup defines the group of Karmada Agent
KarmadaAgentGroup = "system:nodes"
// KarmadaAgentAutoApproveBootstrapClusterRoleBinding defines the name of the ClusterRoleBinding that makes the csrapprover approve agent CSRs
KarmadaAgentAutoApproveBootstrapClusterRoleBinding = "karmada:agent-autoapprove-bootstrap"
// KarmadaAgentAutoApproveCertificateRotationClusterRoleBinding defines name of the ClusterRoleBinding that makes the csrapprover approve agent auto rotated CSRs
KarmadaAgentAutoApproveCertificateRotationClusterRoleBinding = "karmada:agent-autoapprove-certificate-rotation"
// CSRAutoApprovalClusterRoleName defines the name of the auto-bootstrapped ClusterRole for making the csrapprover controller auto-approve the CSR
CSRAutoApprovalClusterRoleName = "system:certificates.k8s.io:certificatesigningrequests:nodeclient"
// KarmadaAgentSelfCSRAutoApprovalClusterRoleName is a role for automatic CSR approvals for automatically rotated agent certificates
KarmadaAgentSelfCSRAutoApprovalClusterRoleName = "system:certificates.k8s.io:certificatesigningrequests:selfnodeclient"
// KarmadaAgentBootstrapTokenAuthGroup specifies which group a Karmada Agent Bootstrap Token should be authenticated in
KarmadaAgentBootstrapTokenAuthGroup = "system:bootstrappers:karmada:default-cluster-token"
)
// AllowBootstrapTokensToPostCSRs creates RBAC rules in a way the makes Karmada Agent Bootstrap Tokens able to post CSRs
func AllowBootstrapTokensToPostCSRs(clientSet *kubernetes.Clientset) error {
klog.Infoln("[bootstrap-token] configured RBAC rules to allow Karmada Agent Bootstrap tokens to post CSRs in order for agent to get long term certificate credentials")
clusterRoleBinding := utils.ClusterRoleBindingFromSubjects(KarmadaAgentBootstrap, KarmadaAgentBootstrapperClusterRoleName,
[]rbacv1.Subject{
{
Kind: rbacv1.GroupKind,
Name: KarmadaAgentBootstrapTokenAuthGroup,
},
}, nil)
return utils.CreateIfNotExistClusterRoleBinding(clientSet, clusterRoleBinding)
}
// AutoApproveKarmadaAgentBootstrapTokens creates RBAC rules in a way that makes Karmada Agent Bootstrap Tokens' CSR auto-approved by the csrapprover controller
func AutoApproveKarmadaAgentBootstrapTokens(clientSet *kubernetes.Clientset) error {
klog.Infoln("[bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Karmada Agent Bootstrap Token")
clusterRoleBinding := utils.ClusterRoleBindingFromSubjects(KarmadaAgentAutoApproveBootstrapClusterRoleBinding, CSRAutoApprovalClusterRoleName,
[]rbacv1.Subject{
{
Kind: rbacv1.GroupKind,
Name: KarmadaAgentBootstrapTokenAuthGroup,
},
}, nil)
return utils.CreateIfNotExistClusterRoleBinding(clientSet, clusterRoleBinding)
}
// AutoApproveAgentCertificateRotation creates RBAC rules in a way that makes Agent certificate rotation CSR auto-approved by the csrapprover controller
func AutoApproveAgentCertificateRotation(clientSet *kubernetes.Clientset) error {
klog.Infoln("[bootstrap-token] configured RBAC rules to allow certificate rotation for all agent client certificates in the member cluster")
clusterRoleBinding := utils.ClusterRoleBindingFromSubjects(KarmadaAgentAutoApproveCertificateRotationClusterRoleBinding, KarmadaAgentSelfCSRAutoApprovalClusterRoleName,
[]rbacv1.Subject{
{
Kind: rbacv1.GroupKind,
Name: KarmadaAgentGroup,
},
}, nil)
return utils.CreateIfNotExistClusterRoleBinding(clientSet, clusterRoleBinding)
}

18
pkg/karmadactl/cmdinit/karmada/deploy.go
View File

@ -22,6 +22,7 @@ import (
apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
"sigs.k8s.io/yaml"
bootstrapagent "github.com/karmada-io/karmada/pkg/karmadactl/cmdinit/bootstraptoken/agent"
"github.com/karmada-io/karmada/pkg/karmadactl/cmdinit/bootstraptoken/clusterinfo"
"github.com/karmada-io/karmada/pkg/karmadactl/cmdinit/options"
"github.com/karmada-io/karmada/pkg/karmadactl/cmdinit/utils"
@ -121,6 +122,23 @@ func createExtralResources(clientSet *kubernetes.Clientset, dir string) error {
return fmt.Errorf("error creating clusterinfo RBAC rules: %v", err)
}
// grant limited access permission to 'karmada-agent'
if err := grantAccessPermissionToAgent(clientSet); err != nil {
return err
}
if err := bootstrapagent.AllowBootstrapTokensToPostCSRs(clientSet); err != nil {
return err
}
if err := bootstrapagent.AutoApproveKarmadaAgentBootstrapTokens(clientSet); err != nil {
return err
}
if err := bootstrapagent.AutoApproveAgentCertificateRotation(clientSet); err != nil {
return err
}
return nil
}

88
pkg/karmadactl/cmdinit/karmada/rbac.go
View File

@ -7,6 +7,11 @@ import (
"github.com/karmada-io/karmada/pkg/karmadactl/cmdinit/utils"
)
const (
karmadaAgentAccessClusterRole = "system:karmada:agent"
karmadaAgentGroup = "system:nodes"
)
// grantProxyPermissionToAdmin grants the proxy permission to "system:admin"
func grantProxyPermissionToAdmin(clientSet *kubernetes.Clientset) error {
proxyAdminClusterRole := utils.ClusterRoleFromRules(clusterProxyAdminRole, []rbacv1.PolicyRule{
@ -34,3 +39,86 @@ func grantProxyPermissionToAdmin(clientSet *kubernetes.Clientset) error {
return nil
}
// grantAccessPermissionToAgent grants the limited access permmission to 'karmada-agent'
func grantAccessPermissionToAgent(clientSet *kubernetes.Clientset) error {
clusterRole := utils.ClusterRoleFromRules(karmadaAgentAccessClusterRole, []rbacv1.PolicyRule{
{
APIGroups: []string{"authentication.k8s.io"},
Resources: []string{"tokenreviews"},
Verbs: []string{"create"},
},
{
APIGroups: []string{"cluster.karmada.io"},
Resources: []string{"clusters"},
Verbs: []string{"create", "get", "list", "watch", "patch", "update"},
},
{
APIGroups: []string{"cluster.karmada.io"},
Resources: []string{"clusters/status"},
Verbs: []string{"patch", "update"},
},
{
APIGroups: []string{"work.karmada.io"},
Resources: []string{"works"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{"work.karmada.io"},
Resources: []string{"works/status"},
Verbs: []string{"patch", "update"},
},
{
APIGroups: []string{"config.karmada.io"},
Resources: []string{"resourceinterpreterwebhookconfigurations"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{"config.karmada.io"},
Resources: []string{"resourceinterpreterwebhookconfigurations"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{""},
Resources: []string{"namespaces"},
Verbs: []string{"get", "list", "watch", "create"},
},
{
APIGroups: []string{""},
Resources: []string{"secrets"},
Verbs: []string{"get", "list", "watch", "create", "patch"},
},
{
APIGroups: []string{"coordination.k8s.io"},
Resources: []string{"leases"},
Verbs: []string{"create", "delete", "get", "patch", "update"},
},
{
APIGroups: []string{"certificates.k8s.io"},
Resources: []string{"certificatesigningrequests"},
Verbs: []string{"create", "get", "list", "watch"},
},
{
APIGroups: []string{""},
Resources: []string{"events"},
Verbs: []string{"create", "patch", "update"},
},
}, nil)
err := utils.CreateIfNotExistClusterRole(clientSet, clusterRole)
if err != nil {
return err
}
clusterRoleBinding := utils.ClusterRoleBindingFromSubjects(karmadaAgentAccessClusterRole, karmadaAgentAccessClusterRole,
[]rbacv1.Subject{
{
Kind: rbacv1.GroupKind,
Name: karmadaAgentGroup,
}}, nil)
err = utils.CreateIfNotExistClusterRoleBinding(clientSet, clusterRoleBinding)
if err != nil {
return err
}
return nil
}

3
pkg/karmadactl/cmdinit/kubernetes/deployments.go
View File

@ -65,7 +65,6 @@ func (i *CommandInitOption) karmadaAPIServerContainerCommand() []string {
"--allow-privileged=true",
"--authorization-mode=Node,RBAC",
fmt.Sprintf("--client-ca-file=%s/%s.crt", karmadaCertsVolumeMountPath, options.CaCertAndKeyName),
"--enable-admission-plugins=NodeRestriction",
"--enable-bootstrap-token-auth=true",
fmt.Sprintf("--etcd-cafile=%s/%s.crt", karmadaCertsVolumeMountPath, options.EtcdCaCertAndKeyName),
fmt.Sprintf("--etcd-certfile=%s/%s.crt", karmadaCertsVolumeMountPath, options.EtcdClientCertAndKeyName),
@ -268,7 +267,7 @@ func (i *CommandInitOption) makeKarmadaKubeControllerManagerDeployment() *appsv1
fmt.Sprintf("--cluster-name=%s", options.ClusterName),
fmt.Sprintf("--cluster-signing-cert-file=%s/%s.crt", karmadaCertsVolumeMountPath, options.CaCertAndKeyName),
fmt.Sprintf("--cluster-signing-key-file=%s/%s.key", karmadaCertsVolumeMountPath, options.CaCertAndKeyName),
"--controllers=namespace,garbagecollector,serviceaccount-token",
"--controllers=namespace,garbagecollector,serviceaccount-token,ttl-after-finished,bootstrapsigner,tokencleaner,csrapproving,csrcleaner,csrsigning",
"--kubeconfig=/etc/kubeconfig",
"--leader-elect=true",
fmt.Sprintf("--leader-elect-resource-namespace=%s", i.Namespace),