You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2021/10/22 20:10:38 UTC
[GitHub] [apisix-ingress-controller] haowang-pony opened a new issue #719: request help: Does apisix-ingress-controller service account require coordination.k8s.io in clusterRule
haowang-pony opened a new issue #719:
URL: https://github.com/apache/apisix-ingress-controller/issues/719
### Issue description
I want restrict apisix-ingress-controller service account into `ingress-apisix` namespace rather than cluster wise. However I met such error:
`E1023 04:08:38.496282 1 leaderelection.go:325] error retrieving resource lock default/ingress-apisix-leader: leases.coordination.k8s.io "ingress-apisix-leader" is forbidden: User "system:serviceaccount:ingress-apisix:ingress-apisix" cannot get resource "leases" in API group "coordination.k8s.io" in the namespace "default"`
My service account config is:
```
apiVersion: apps/v1
items:
- apiVersion: v1
kind: ServiceAccount
metadata:
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
- apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: nginx-ingress-clusterrole
rules:
- apiGroups:
- ''
resources:
- configmaps
- endpoints
- nodes
- pods
- secrets
verbs:
- list
- watch
- apiGroups:
- ''
resources:
- nodes
verbs:
- get
- apiGroups:
- ''
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- extensions
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- ''
resources:
- events
verbs:
- create
- patch
- apiGroups:
- extensions
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
name: nginx-ingress-role
namespace: ingress-nginx
rules:
- apiGroups:
- ''
resources:
- configmaps
- pods
- secrets
- namespaces
verbs:
- get
- apiGroups:
- ''
resourceNames:
- ingress-controller-leader-nginx
resources:
- configmaps
verbs:
- get
- update
- apiGroups:
- ''
resources:
- configmaps
verbs:
- create
- apiGroups:
- ''
resources:
- endpoints
verbs:
- get
- apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: nginx-ingress-role-nisa-binding
namespace: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: nginx-ingress-role
subjects:
- kind: ServiceAccount
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
- apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: nginx-ingress-clusterrole-nisa-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: nginx-ingress-clusterrole
subjects:
- kind: ServiceAccount
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
kind: List
```
### Environment
* your apisix-ingress-controller version (output of `apisix-ingress-controller version --long`); 1.2.0
* your Kubernetes cluster version (output of `kubectl version`); v1.19.14
* if you run apisix-ingress-controller in Bare-metal environment, also show your OS version (`uname -a`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-ingress-controller] nic-6443 commented on issue #719: request help: Does apisix-ingress-controller service account require coordination.k8s.io in clusterRule
Posted by GitBox <gi...@apache.org>.
nic-6443 commented on issue #719:
URL: https://github.com/apache/apisix-ingress-controller/issues/719#issuecomment-962382087
> AFAIK, a ServiceAccount cannot bind to a ClusterRole and a Role at the same while, we need ClusterRole since we need to watch a few namespaces. So It's tough to be restrictive about the `lease` resource just by the native RBAC implementation, maybe you can resort to tools like OpenPolicyAgent to add extra policies to restrict the behaviors for `lease`.
I verified that sa can bind clusterrole and role at the same time, this is the test manifests I used:
```
apiVersion: v1
kind: Namespace
metadata:
name: rbac
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: test
namespace: rbac
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: test-clusterrole
rules:
- apiGroups:
- ""
resources:
- endpoints
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: test-role
namespace: rbac
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: test-clusterrolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: test-clusterrole
subjects:
- kind: ServiceAccount
name: test
namespace: rbac
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: test-rolebinding
namespace: rbac
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: test-role
subjects:
- kind: ServiceAccount
name: test
namespace: rbac
```
commands to verify permissions:
```
➜ rbac kubectl auth can-i get endpoints --as=system:serviceaccount:rbac:test
yes
➜ rbac kubectl auth can-i get configmaps -n rbac --as=system:serviceaccount:rbac:test
yes
➜ rbac kubectl auth can-i get configmaps --as=system:serviceaccount:rbac:test
no
```
So maybe we can reconsider the rbac permission for lease
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-ingress-controller] tokers commented on issue #719: request help: Does apisix-ingress-controller service account require coordination.k8s.io in clusterRule
Posted by GitBox <gi...@apache.org>.
tokers commented on issue #719:
URL: https://github.com/apache/apisix-ingress-controller/issues/719#issuecomment-952580665
AFAIK, a ServiceAccount cannot bind to a ClusterRole and a Role at the same while, we need ClusterRole since we need to watch a few namespaces. So It's tough to be restrictive about the `lease` resource just by the native RBAC implementation, maybe you can resort to tools like OpenPolicyAgent to add extra policies to restrict the behaviors for `lease`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-ingress-controller] tao12345666333 commented on issue #719: request help: Does apisix-ingress-controller service account require coordination.k8s.io in clusterRule
Posted by GitBox <gi...@apache.org>.
tao12345666333 commented on issue #719:
URL: https://github.com/apache/apisix-ingress-controller/issues/719#issuecomment-952577135
@tokers PTAL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org