Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Paste
P8918
RBAC for Toolforge suggestion
Active
Public
Actions
Authored by
•
Bstorm
on Aug 15 2019, 5:01 PM.
Edit Paste
Archive Paste
View Raw File
Subscribe
Mute Notifications
Award Token
Flag For Later
Tags
None
Referenced Files
F30040165: raw.txt
Aug 15 2019, 5:01 PM
2019-08-15 17:01:39 (UTC+0)
Subscribers
•
Bstorm
# RBAC minimum perms for toolforge users, based on the "edit" system clusterrole with some permissions commented out:
# verbs for R/O
# ["get", "list", "watch"]
# verbs for R/W
# ["get", "list", "watch", "create", "update", "patch", "delete"]
# resources needed by Toolforge users for sure:
# pods, deployments,
rules:
- apiGroups:
- ""
resources:
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
- secrets
- services/proxy
verbs:
- get
- list
- watch
# - apiGroups:
# - ""
# resources:
# - serviceaccounts
# verbs:
# - impersonate
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- ""
resources:
- configmaps
- endpoints
# - persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- secrets
# - serviceaccounts
- services
- services/proxy
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- apps
resources:
# - daemonsets
- deployments
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- statefulsets/scale
verbs:
- create
- delete
- deletecollection
- patch
- update
# - apiGroups:
# - autoscaling
# resources:
# - horizontalpodautoscalers
# verbs:
# - create
# - delete
# - deletecollection
# - patch
# - update
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- extensions
resources:
# - daemonsets
- deployments
- deployments/rollback
- deployments/scale
- ingresses
- networkpolicies
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- create
- delete
- deletecollection
- patch
- update
# - apiGroups:
# - policy
# resources:
# - poddisruptionbudgets
# verbs:
# - create
# - delete
# - deletecollection
# - patch
# - update
- apiGroups:
- networking.k8s.io
resources:
- ingresses
- networkpolicies
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- persistentvolumeclaims
- pods
- replicationcontrollers
- replicationcontrollers/scale
# - serviceaccounts
- services
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- bindings
- events
- limitranges
- namespaces/status
- pods/log
- pods/status
- replicationcontrollers/status
- resourcequotas
- resourcequotas/status
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- controllerrevisions
- daemonsets
- deployments
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- statefulsets/scale
verbs:
- get
- list
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- get
- list
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- deployments
- deployments/scale
- ingresses
- networkpolicies
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- get
- list
- watch
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
- networkpolicies
verbs:
- get
- list
- watch
Event Timeline
•
Bstorm
created this paste.
Aug 15 2019, 5:01 PM
2019-08-15 17:01:39 (UTC+0)
•
Bstorm
mentioned this in
T228499: Toolforge: changes to maintain-kubeusers
.
Aug 15 2019, 5:04 PM
2019-08-15 17:04:06 (UTC+0)
•
Bstorm
mentioned this in
T227290: Design and document how to integrate the new Toolforge k8s cluster with PodSecurityPolicy
.
Aug 15 2019, 5:40 PM
2019-08-15 17:40:04 (UTC+0)
Log In to Comment