Remove ClusterRole permissions for extensions API group #2216
Conversation
|
The last associated PR I found was #1082 |
jdn5126
force-pushed
the
extension_scope
branch
4 times, most recently
from
ca659bf to
20383c1
Compare
|
Did you test this with custom networking? We were not able to get ENIconfigs CRD without the extensions RBAC, #1082 description has the logs. It would be good to confirm. |
Oh, I don't think I ran custom networking tests, let me try that now. I started this assuming that I would need to change |
jdn5126
force-pushed
the
extension_scope
branch
from
20383c1 to
342ecd4
Compare
I ran the custom_networking e2e tests without the extensions RBAC and the tests still passed. Are there any specific cases you think I should cover with custom networking? The test cases do cover ENIConfig |
|
I am wondering it is not an issue now because we are fetching from node cache, if we are able to fetch eniconfigs and allocate ENIs then we should be good. |
jdn5126
force-pushed
the
extension_scope
branch
2 times, most recently
from
adbd034 to
0ae68d7
Compare
|
We need to track MAO and default manifest changes for this. |
jdn5126
force-pushed
the
extension_scope
branch
from
0ae68d7 to
be87071
Compare
jdn5126
force-pushed
the
extension_scope
branch
from
be87071 to
1d7af6a
Compare
What type of PR is this?
cleanup
Which issue does this PR fix:
#1232
What does this PR do / Why do we need it:
This PR removes ClusterRole permissions for
extensionsAPI group. From what I can tell, the aws-node pod does not need list or watch permissions for any extensions.Looking at the history, these permissions were originally added for
daemonsets, but aws-node does not need to list or watch any other daemonsets. It does not need to list or watch any deployments or replicasets either.If an issue # is not available please add repro steps and logs from IPAMD/CNI showing the issue:
N/A
Testing done on this change:
Manually ran all IPv4 and IPv6 integration and e2e tests and did not run into any issues.
Automation added to e2e:
N/A
Will this PR introduce any new dependencies?:
No
Will this break upgrades or downgrades. Has updating a running cluster been tested?:
This will not break upgrades or downgrades. A running cluster has been tested.
Does this change require updates to the CNI daemonset config files to work?:
Yes
Does this PR introduce any user-facing change?:
Yes
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.