Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Separate calico-node and calico-cni-plugin service accounts #7106

Merged
merged 14 commits into from
Mar 24, 2023
Merged

Separate calico-node and calico-cni-plugin service accounts #7106

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
92ecc2f
calico-cni-plugin user
MichalFupso Dec 19, 2022
2ccfb10
add calico-cni-plugin account
MichalFupso Dec 19, 2022
776f615
calico-cni-plugin updates
MichalFupso Jan 13, 2023
2782961
cni account name update
MichalFupso Jan 13, 2023
a1d66ef
naming update
MichalFupso Jan 13, 2023
e53ca6c
naming
MichalFupso Jan 13, 2023
658126e
manifest files update
MichalFupso Jan 25, 2023
03bfd2d
Merge branch 'master' into calico-cni-plugin
MichalFupso Feb 28, 2023
df303f6
calico-cni token test
MichalFupso Feb 28, 2023
3c61908
calico-node token
MichalFupso Mar 13, 2023
7e80e32
Merge branch 'master' into calico-cni-plugin
MichalFupso Mar 15, 2023
bdf436a
calico-cni-plugin service account
MichalFupso Mar 21, 2023
6649e27
static check fix
MichalFupso Mar 23, 2023
e373cea
imports
MichalFupso Mar 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 56 additions & 1 deletion charts/calico/templates/calico-node-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,10 @@ rules:
resourceNames:
{{- if eq .Values.network "flannel" }}
- canal
- calico-cni-plugin
{{- else }}
- calico-node
- calico-cni-plugin
{{- end }}
verbs:
- create
Expand All @@ -31,7 +33,7 @@ rules:
resources:
- endpointslices
verbs:
- watch
- watch
- list
- apiGroups: [""]
resources:
Expand Down Expand Up @@ -177,6 +179,47 @@ rules:

---

# CNI cluster role
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadate:
name: calico-cni-plugin
rules:
- apiGroups: [""]
resources:
- pods
- nodes
- namespaces
verbs:
- get
{{- if eq .Values.datastore "kubernetes" }}
- apiGroups: [""]
resources:
- pods/status
verbs:
- patch
{{- if eq .Values.network "calico" }}
- apiGroups: ["crd.projectcalico.org"]
resources:
- blockaffinities
- ipamblocks
- ipamhandles
verbs:
- get
- list
- create
- update
- delete
- apiGroups: [ "crd.projectcalico.org" ]
resources:
- ipamconfigs
verbs:
- get
- create
{{- end }}
{{- end }}
---

{{- if eq .Values.network "flannel" }}
# Flannel ClusterRole
# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml
Expand Down Expand Up @@ -242,3 +285,15 @@ subjects:
name: calico-node
namespace: kube-system
{{- end }}
kind: ClusterRoleBinding
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this can be a RoleBinding since it's only for a single serviceaccount in one namespace.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In your other PR, this is a RoleBinding: https://github.com/tigera/operator/pull/2393/files#diff-d4d31d15e69aa9a0bad7776e758dfbd50b8e0e1a969fd16719f56c470cac4e7bR316

apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: calico-cni-plugin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-cni-plugin
subject:
kind: ServiceAccount
name: calico-cni-plugin
namespace: kube-system
52 changes: 51 additions & 1 deletion manifests/calico-bpf.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4360,6 +4360,7 @@ rules:
- serviceaccounts/token
resourceNames:
- calico-node
- calico-cni-plugin
verbs:
- create
# The CNI plugin needs to get pods, nodes, and namespaces.
Expand All @@ -4376,7 +4377,7 @@ rules:
resources:
- endpointslices
verbs:
- watch
- watch
- list
- apiGroups: [""]
resources:
Expand Down Expand Up @@ -4514,6 +4515,43 @@ rules:
verbs:
- get
---
# Source: calico/templates/calico-node-rbac.yaml
# CNI cluster role
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadate:
name: calico-cni-plugin
rules:
- apiGroups: [""]
resources:
- pods
- nodes
- namespaces
verbs:
- get
- apiGroups: [""]
resources:
- pods/status
verbs:
- patch
- apiGroups: ["crd.projectcalico.org"]
resources:
- blockaffinities
- ipamblocks
- ipamhandles
verbs:
- get
- list
- create
- update
- delete
- apiGroups: [ "crd.projectcalico.org" ]
resources:
- ipamconfigs
verbs:
- get
- create
---
# Source: calico/templates/calico-kube-controllers-rbac.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
Expand Down Expand Up @@ -4541,6 +4579,18 @@ subjects:
- kind: ServiceAccount
name: calico-node
namespace: kube-system
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: calico-cni-plugin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-cni-plugin
subject:
kind: ServiceAccount
name: calico-cni-plugin
namespace: kube-system
---
# Source: calico/templates/calico-node.yaml
# This manifest installs the calico-node container, as well
Expand Down
30 changes: 29 additions & 1 deletion manifests/calico-etcd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,7 @@ rules:
- serviceaccounts/token
resourceNames:
- calico-node
- calico-cni-plugin
verbs:
- create
# The CNI plugin needs to get pods, nodes, and namespaces.
Expand All @@ -170,7 +171,7 @@ rules:
resources:
- endpointslices
verbs:
- watch
- watch
- list
- apiGroups: [""]
resources:
Expand All @@ -193,6 +194,21 @@ rules:
# Needed for clearing NodeNetworkUnavailable flag.
- patch
---
# Source: calico/templates/calico-node-rbac.yaml
# CNI cluster role
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadate:
name: calico-cni-plugin
rules:
- apiGroups: [""]
resources:
- pods
- nodes
- namespaces
verbs:
- get
---
# Source: calico/templates/calico-kube-controllers-rbac.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
Expand Down Expand Up @@ -220,6 +236,18 @@ subjects:
- kind: ServiceAccount
name: calico-node
namespace: kube-system
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: calico-cni-plugin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-cni-plugin
subject:
kind: ServiceAccount
name: calico-cni-plugin
namespace: kube-system
---
# Source: calico/templates/calico-node.yaml
# This manifest installs the calico-node container, as well
Expand Down
35 changes: 34 additions & 1 deletion manifests/calico-policy-only.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4370,6 +4370,7 @@ rules:
- serviceaccounts/token
resourceNames:
- calico-node
- calico-cni-plugin
verbs:
- create
# The CNI plugin needs to get pods, nodes, and namespaces.
Expand All @@ -4386,7 +4387,7 @@ rules:
resources:
- endpointslices
verbs:
- watch
- watch
- list
- apiGroups: [""]
resources:
Expand Down Expand Up @@ -4491,6 +4492,26 @@ rules:
- create
- update
---
# Source: calico/templates/calico-node-rbac.yaml
# CNI cluster role
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadate:
name: calico-cni-plugin
rules:
- apiGroups: [""]
resources:
- pods
- nodes
- namespaces
verbs:
- get
- apiGroups: [""]
resources:
- pods/status
verbs:
- patch
---
# Source: calico/templates/calico-kube-controllers-rbac.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
Expand Down Expand Up @@ -4518,6 +4539,18 @@ subjects:
- kind: ServiceAccount
name: calico-node
namespace: kube-system
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: calico-cni-plugin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-cni-plugin
subject:
kind: ServiceAccount
name: calico-cni-plugin
namespace: kube-system
---
# Source: calico/templates/calico-typha.yaml
# This manifest creates a Service, which will be backed by Calico's Typha daemon.
Expand Down
52 changes: 51 additions & 1 deletion manifests/calico-typha.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4371,6 +4371,7 @@ rules:
- serviceaccounts/token
resourceNames:
- calico-node
- calico-cni-plugin
verbs:
- create
# The CNI plugin needs to get pods, nodes, and namespaces.
Expand All @@ -4387,7 +4388,7 @@ rules:
resources:
- endpointslices
verbs:
- watch
- watch
- list
- apiGroups: [""]
resources:
Expand Down Expand Up @@ -4525,6 +4526,43 @@ rules:
verbs:
- get
---
# Source: calico/templates/calico-node-rbac.yaml
# CNI cluster role
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadate:
name: calico-cni-plugin
rules:
- apiGroups: [""]
resources:
- pods
- nodes
- namespaces
verbs:
- get
- apiGroups: [""]
resources:
- pods/status
verbs:
- patch
- apiGroups: ["crd.projectcalico.org"]
resources:
- blockaffinities
- ipamblocks
- ipamhandles
verbs:
- get
- list
- create
- update
- delete
- apiGroups: [ "crd.projectcalico.org" ]
resources:
- ipamconfigs
verbs:
- get
- create
---
# Source: calico/templates/calico-kube-controllers-rbac.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
Expand Down Expand Up @@ -4552,6 +4590,18 @@ subjects:
- kind: ServiceAccount
name: calico-node
namespace: kube-system
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: calico-cni-plugin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-cni-plugin
subject:
kind: ServiceAccount
name: calico-cni-plugin
namespace: kube-system
---
# Source: calico/templates/calico-typha.yaml
# This manifest creates a Service, which will be backed by Calico's Typha daemon.
Expand Down
Loading