Skip to content

Commit 496ac7f

Browse files
ispeakc0deispeakc0de
authored
chore(rbac): Consolidate the serviceaccounts in the chaos infrastructure (#4598)
* chore(rbac): Consolidate the serviceaccounts in the chaos infrastructure Signed-off-by: Shubham Chaudhary <[email protected]> * add rbac for event tracker Signed-off-by: Shubham Chaudhary <[email protected]> --------- Signed-off-by: Shubham Chaudhary <[email protected]>
1 parent a102b66 commit 496ac7f

15 files changed

+583
-863
lines changed

‎chaoscenter/graphql/server/manifests/cluster/1b_argo_rbac.yaml

Lines changed: 34 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -2,54 +2,53 @@
22
apiVersion: v1
33
kind: ServiceAccount
44
metadata:
5-
name: argo
5+
name: argo-chaos
66
namespace: #{INFRA_NAMESPACE}
77
---
88
apiVersion: rbac.authorization.k8s.io/v1
99
kind: ClusterRole
1010
metadata:
11-
name: argo-cluster-role
11+
name: chaos-cluster-role
1212
rules:
13-
- apiGroups: [""]
14-
resources: ["pods", "pods/exec"]
15-
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
16-
- apiGroups: [""]
17-
resources: ["configmaps"]
18-
verbs: ["get", "watch", "list"]
19-
- apiGroups: [""]
20-
resources: ["persistentvolumeclaims"]
21-
verbs: ["create", "delete"]
22-
- apiGroups: ["argoproj.io"]
23-
resources: ["workflows", "workflows/finalizers"]
24-
verbs: ["get", "list", "watch", "update", "patch", "delete", "create"]
25-
- apiGroups: ["argoproj.io"]
26-
resources: ["workflowtemplates","workflowtemplates/finalizers","clusterworkflowtemplates","clusterworkflowtemplates/finalizers","workflowtasksets"]
27-
verbs: ["get", "list", "watch"]
28-
- apiGroups: ["argoproj.io"]
29-
resources: ["workflowtaskresults"]
30-
verbs: ["list", "watch", "deletecollection"]
31-
- apiGroups: [""]
32-
resources: ["serviceaccounts"]
33-
verbs: ["get", "list"]
34-
- apiGroups: ["argoproj.io"]
35-
resources: ["cronworkflows", "cronworkflows/finalizers"]
36-
verbs: ["get", "list", "watch", "update", "patch", "delete"]
37-
- apiGroups: [""]
38-
resources: ["events"]
39-
verbs: ["create", "patch"]
40-
- apiGroups: ["policy"]
41-
resources: ["poddisruptionbudgets"]
42-
verbs: ["create", "get", "delete"]
13+
# for managing the pods created by workflow controller to implement individual steps in the workflow
14+
- apiGroups: ['']
15+
resources: ['pods', 'services']
16+
verbs: ['create', 'get', 'watch', 'patch', 'delete', 'list']
17+
- apiGroups: ['']
18+
resources: ['namespaces']
19+
verbs: ['get', 'watch', 'patch', 'list']
20+
21+
# for tracking & getting logs of the pods created by workflow controller to implement individual steps in the workflow
22+
- apiGroups: ['']
23+
resources: ['pods/log', 'pods/exec']
24+
verbs: ['get', 'watch', 'create', 'delete', 'patch']
25+
- apiGroups: ['']
26+
resources: ['secrets', 'configmaps']
27+
verbs: ['get', 'watch', 'create', 'patch']
28+
29+
# for creation & deletion of application in predefined workflows
30+
- apiGroups: ['apps']
31+
resources: ['deployments']
32+
verbs: ['delete']
33+
- apiGroups: ['apps']
34+
resources: ['deployments', 'statefulsets']
35+
verbs: ['get', 'watch', 'patch' , 'create']
36+
37+
# for creation, status polling and deletion of litmus chaos resources used within a chaos workflow
38+
- apiGroups: ["litmuschaos.io"]
39+
resources:
40+
["chaosengines", "chaosexperiments", "chaosresults", "chaosschedules"]
41+
verbs: ["create", "list", "get", "patch", "delete", "watch"]
4342
---
4443
apiVersion: rbac.authorization.k8s.io/v1
4544
kind: ClusterRoleBinding
4645
metadata:
47-
name: argo-binding
46+
name: chaos-cluster-role-binding
4847
roleRef:
4948
apiGroup: rbac.authorization.k8s.io
5049
kind: ClusterRole
51-
name: argo-cluster-role
50+
name: chaos-cluster-role
5251
subjects:
5352
- kind: ServiceAccount
54-
name: argo
53+
name: argo-chaos
5554
namespace: #{INFRA_NAMESPACE}

‎chaoscenter/graphql/server/manifests/cluster/1c_argo_deployment.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,4 +67,4 @@ spec:
6767
memory: "500Mi"
6868
cpu: "225m"
6969
ephemeral-storage: "1Gi"
70-
serviceAccountName: argo
70+
serviceAccountName: #{INFRA_SERVICE_ACCOUNT}

‎chaoscenter/graphql/server/manifests/cluster/2b_litmus_admin_rbac.yaml

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: litmus-admin
6+
namespace: #{INFRA_NAMESPACE}
7+
labels:
8+
name: litmus-admin
9+
---
10+
# Source: openebs/templates/clusterrole.yaml
11+
apiVersion: rbac.authorization.k8s.io/v1
12+
kind: ClusterRole
13+
metadata:
14+
name: litmus-admin
15+
labels:
16+
name: litmus-admin
17+
rules:
18+
# ***************************************************************************************
19+
# Permissions needed for preparing and monitor the chaos resources by chaos-runner
20+
# ***************************************************************************************
21+
22+
# The chaos operator watches the chaosengine resource and orchestrates the chaos experiment..
23+
## .. by creating the chaos-runner
24+
25+
# for creating and monitoring the chaos-runner pods
26+
- apiGroups: [""]
27+
resources: ["pods"]
28+
verbs: ["create","delete","get","list","patch","update", "deletecollection"]
29+
- apiGroups: [""]
30+
resources: ["events"]
31+
verbs: ["create","get","list","patch","update"]
32+
33+
# for fetching configmaps and secrets to inject into chaos-runner pod (if specified)
34+
- apiGroups: [""]
35+
resources: ["secrets", "configmaps"]
36+
verbs: ["get", "list"]
37+
38+
# for tracking & getting logs of the pods created by chaos-runner to implement individual steps in the runner
39+
- apiGroups: [""]
40+
resources: ["pods/log"]
41+
verbs: ["get", "list", "watch"]
42+
43+
# for configuring and monitor the experiment job by chaos-runner pod
44+
- apiGroups: ["batch"]
45+
resources: ["jobs"]
46+
verbs: ["create", "list", "get", "delete", "deletecollection"]
47+
48+
# ********************************************************************
49+
# Permissions needed for creation and discovery of chaos experiments
50+
# ********************************************************************
51+
52+
# The helper pods are created by experiment to perform the actual chaos injection ...
53+
# ... for a period of chaos duration
54+
55+
# for creating and managing to execute comands inside target container
56+
- apiGroups: [""]
57+
resources: ["pods/exec","pods/eviction","replicationcontrollers"]
58+
verbs: ["get","list","create"]
59+
60+
# for tracking & getting logs of the pods created by experiment pod to implement individual steps in the experiment
61+
- apiGroups: [""]
62+
resources: ["pods/log"]
63+
verbs: ["get", "list", "watch"]
64+
65+
# for creating and monitoring liveness services or monitoring target app services during chaos injection
66+
- apiGroups: [""]
67+
resources: ["services"]
68+
verbs: ["create","get","list"]
69+
70+
# for checking the app parent resources as deployments or sts and are eligible chaos candidates
71+
- apiGroups: ["apps"]
72+
resources: ["deployments", "statefulsets"]
73+
verbs: ["list", "get", "patch", "update"]
74+
75+
# for checking the app parent resources as replicasets and are eligible chaos candidates
76+
- apiGroups: ["apps"]
77+
resources: ["replicasets"]
78+
verbs: ["list", "get"]
79+
80+
# for checking the app parent resources as deamonsets and are eligible chaos candidates
81+
- apiGroups: ["apps"]
82+
resources: ["daemonsets"]
83+
verbs: ["list","get"]
84+
85+
# for checking (openshift) app parent resources if they are eligible chaos candidates
86+
- apiGroups: ["apps.openshift.io"]
87+
resources: ["deploymentconfigs"]
88+
verbs: ["list", "get"]
89+
90+
# for checking (argo) app parent resources if they are eligible chaos candidates
91+
- apiGroups: ["argoproj.io"]
92+
resources: ["rollouts"]
93+
verbs: ["list", "get"]
94+
95+
# performs CRUD operations on the network policies
96+
- apiGroups: ["networking.k8s.io"]
97+
resources: ["networkpolicies"]
98+
verbs: ["create","delete","list","get"]
99+
100+
# for creation, status polling and deletion of litmus chaos resources used within a chaos workflow
101+
- apiGroups: ["litmuschaos.io"]
102+
resources: ["chaosengines","chaosexperiments","chaosresults"]
103+
verbs: ["create","list","get","patch","update","delete"]
104+
105+
# for experiment to perform node status checks and other node level operations like taint, drain in the experiment.
106+
- apiGroups: [""]
107+
resources: ["nodes"]
108+
verbs: ["patch", "get", "list", "update"]
109+
---
110+
apiVersion: rbac.authorization.k8s.io/v1
111+
kind: ClusterRoleBinding
112+
metadata:
113+
name: litmus-admin
114+
labels:
115+
name: litmus-admin
116+
roleRef:
117+
apiGroup: rbac.authorization.k8s.io
118+
kind: ClusterRole
119+
name: litmus-admin
120+
subjects:
121+
- kind: ServiceAccount
122+
name: litmus-admin
123+
namespace: #{INFRA_NAMESPACE}

‎chaoscenter/graphql/server/manifests/cluster/2b_litmus_rbac.yaml

Lines changed: 0 additions & 115 deletions
This file was deleted.

‎chaoscenter/graphql/server/manifests/cluster/2c_litmus_deployment.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ spec:
3030
app.kubernetes.io/managed-by: kubectl
3131
name: chaos-operator
3232
spec:
33-
serviceAccountName: litmus-cluster-scope
33+
serviceAccountName: #{INFRA_SERVICE_ACCOUNT}
3434
#{TOLERATIONS}
3535
#{NODE_SELECTOR}
3636
containers:
@@ -114,7 +114,7 @@ spec:
114114
memory: "500Mi"
115115
cpu: "225m"
116116
ephemeral-storage: "1Gi"
117-
serviceAccountName: litmus-cluster-scope
117+
serviceAccountName: #{INFRA_SERVICE_ACCOUNT}
118118
---
119119
apiVersion: v1
120120
kind: Service

0 commit comments

Comments
 (0)