369 lines
7.0 KiB
YAML
369 lines
7.0 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cluster-info
|
|
namespace: kube-public
|
|
data:
|
|
kubeconfig: |
|
|
apiVersion: v1
|
|
clusters:
|
|
- cluster:
|
|
certificate-authority-data: {{ca_crt}}
|
|
server: {{apiserver_address}}
|
|
kind: Config
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
labels:
|
|
karmada.io/bootstrapping: rbac-defaults
|
|
name: system:karmada:bootstrap-signer-clusterinfo
|
|
namespace: kube-public
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resourceNames:
|
|
- cluster-info
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
labels:
|
|
karmada.io/bootstrapping: rbac-defaults
|
|
name: system:karmada:bootstrap-signer-clusterinfo
|
|
namespace: kube-public
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: system:karmada:bootstrap-signer-clusterinfo
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: User
|
|
name: system:anonymous
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
labels:
|
|
karmada.io/bootstrapping: rbac-defaults
|
|
name: system:karmada:agent-bootstrap
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: system:node-bootstrapper
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Group
|
|
name: system:bootstrappers:karmada:default-cluster-token
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
labels:
|
|
karmada.io/bootstrapping: rbac-defaults
|
|
name: system:karmada:agent-autoapprove-bootstrap
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Group
|
|
name: system:bootstrappers:karmada:default-cluster-token
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
labels:
|
|
karmada.io/bootstrapping: rbac-defaults
|
|
name: system:karmada:agent-autoapprove-certificate-rotation
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Group
|
|
name: system:nodes
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
karmada.io/bootstrapping: rbac-defaults
|
|
name: system:karmada:agent
|
|
rules:
|
|
- apiGroups:
|
|
- cluster.karmada.io
|
|
resources:
|
|
- clusters
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- watch
|
|
- delete
|
|
- apiGroups:
|
|
- cluster.karmada.io
|
|
resources:
|
|
- clusters/status
|
|
verbs:
|
|
- update
|
|
- apiGroups:
|
|
- work.karmada.io
|
|
resources:
|
|
- works
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- work.karmada.io
|
|
resources:
|
|
- works/status
|
|
verbs:
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- config.karmada.io
|
|
resources:
|
|
- resourceinterpreterwebhookconfigurations
|
|
- resourceinterpretercustomizations
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- namespaces
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- get
|
|
- create
|
|
- patch
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- create
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- certificates.k8s.io
|
|
resources:
|
|
- certificatesigningrequests
|
|
verbs:
|
|
- create
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
- update
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
labels:
|
|
karmada.io/bootstrapping: rbac-defaults
|
|
name: system:karmada:agent
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: system:karmada:agent
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Group
|
|
name: system:nodes
|
|
|
|
# To ensure the agent has the minimal RBAC permissions, the ideal approach is to
|
|
# use different RBAC configurations for different agents of member clusters with pull mode.
|
|
# Below is the minimal set of RBAC permissions required for a single pull mode member cluster.
|
|
# Here are the definitions of the variables used:
|
|
#
|
|
# - clustername: the name of the member cluster.
|
|
# - cluster_namespace: the namespace where the member cluster secrets are stored, default to karmada-cluster.
|
|
#
|
|
# ---
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: ClusterRole
|
|
# metadata:
|
|
# name: system:karmada:agent
|
|
# rules:
|
|
# - apiGroups:
|
|
# - cluster.karmada.io
|
|
# resources:
|
|
# - clusters
|
|
# resourceNames:
|
|
# - {{clustername}}
|
|
# verbs:
|
|
# - create
|
|
# - get
|
|
# - delete
|
|
# - apiGroups:
|
|
# - cluster.karmada.io
|
|
# resources:
|
|
# - clusters
|
|
# verbs:
|
|
# - list
|
|
# - watch
|
|
# - apiGroups:
|
|
# - cluster.karmada.io
|
|
# resources:
|
|
# - clusters/status
|
|
# resourceNames:
|
|
# - {{clustername}}
|
|
# verbs:
|
|
# - update
|
|
# - apiGroups:
|
|
# - config.karmada.io
|
|
# resources:
|
|
# - resourceinterpreterwebhookconfigurations
|
|
# - resourceinterpretercustomizations
|
|
# verbs:
|
|
# - get
|
|
# - list
|
|
# - watch
|
|
# - apiGroups:
|
|
# - ""
|
|
# resources:
|
|
# - namespaces
|
|
# verbs:
|
|
# - get
|
|
# - apiGroups:
|
|
# - coordination.k8s.io
|
|
# resources:
|
|
# - leases
|
|
# verbs:
|
|
# - create
|
|
# - get
|
|
# - update
|
|
# - apiGroups:
|
|
# - certificates.k8s.io
|
|
# resources:
|
|
# - certificatesigningrequests
|
|
# verbs:
|
|
# - create
|
|
# - get
|
|
# - apiGroups:
|
|
# - ""
|
|
# resources:
|
|
# - events
|
|
# verbs:
|
|
# - create
|
|
# - patch
|
|
# - update
|
|
#
|
|
# ---
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: ClusterRoleBinding
|
|
# metadata:
|
|
# name: system:karmada:agent
|
|
# roleRef:
|
|
# apiGroup: rbac.authorization.k8s.io
|
|
# kind: ClusterRole
|
|
# name: system:karmada:agent
|
|
# subjects:
|
|
# - apiGroup: rbac.authorization.k8s.io
|
|
# kind: Group
|
|
# name: system:nodes
|
|
#
|
|
# ---
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: Role
|
|
# metadata:
|
|
# name: system:karmada:agent-secret
|
|
# namespace: "{{cluster_namespace}}"
|
|
# rules:
|
|
# - apiGroups:
|
|
# - ""
|
|
# resources:
|
|
# - secrets
|
|
# resourceNames:
|
|
# - {{clustername}}-impersonator
|
|
# - {{clustername}}
|
|
# verbs:
|
|
# - get
|
|
# - create
|
|
# - patch
|
|
#
|
|
# ---
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: RoleBinding
|
|
# metadata:
|
|
# name: system:karmada:agent-secret
|
|
# namespace: "{{cluster_namespace}}"
|
|
# roleRef:
|
|
# apiGroup: rbac.authorization.k8s.io
|
|
# kind: Role
|
|
# name: system:karmada:agent-secret
|
|
# subjects:
|
|
# - apiGroup: rbac.authorization.k8s.io
|
|
# kind: Group
|
|
# name: system:nodes
|
|
#
|
|
# ---
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: Role
|
|
# metadata:
|
|
# name: system:karmada:agent-work
|
|
# namespace: "karmada-es-{{clustername}}"
|
|
# rules:
|
|
# - apiGroups:
|
|
# - work.karmada.io
|
|
# resources:
|
|
# - works
|
|
# verbs:
|
|
# - create
|
|
# - get
|
|
# - list
|
|
# - watch
|
|
# - update
|
|
# - delete
|
|
# - apiGroups:
|
|
# - work.karmada.io
|
|
# resources:
|
|
# - works/status
|
|
# verbs:
|
|
# - patch
|
|
# - update
|
|
#
|
|
# ---
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: RoleBinding
|
|
# metadata:
|
|
# name: system:karmada:agent-work
|
|
# namespace: "karmada-es-{{clustername}}"
|
|
# roleRef:
|
|
# apiGroup: rbac.authorization.k8s.io
|
|
# kind: Role
|
|
# name: system:karmada:agent-work
|
|
# subjects:
|
|
# - apiGroup: rbac.authorization.k8s.io
|
|
# kind: Group
|
|
# name: system:nodes
|