chore: support define policy rules in helm values #8854
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #8854 +/- ##
==========================================
+ Coverage 60.26% 60.32% +0.05%
==========================================
Files 382 382
Lines 46259 46259
==========================================
+ Hits 27880 27904 +24
+ Misses 15700 15681 -19
+ Partials 2679 2674 -5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
cjc7373
changed the title
| # user defined rules | ||
| {{- with .Values.rbac.additionalPolicyRules }} | ||
| {{ toYaml . }} | ||
| {{- end }} |
There was a problem hiding this comment.
why not definied in cmpd?
There was a problem hiding this comment.
Permissions defined in cmpd can't exceed the permission owned by kubeblocks. So if a user want to define a permission kb does not own by default, he can add it here so that kb owns it.
There was a problem hiding this comment.
Where is this limitation enforced? Is it a restriction within Kubernetes itself, or does KB have validation logic (I can't find the code)?
There was a problem hiding this comment.
It's enforced by Kubernetes. (doc: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping)
There was a problem hiding this comment.
Got it, please update PR description correspondingly.
There was a problem hiding this comment.
Maybe we should just allow the escalation by adding the escalate verb and the bind verb to the RBAC rules of KB, according to the K8s doc.
What do you think? @leon-inf
There was a problem hiding this comment.
Would that be too dangerous?
There was a problem hiding this comment.
The point is:
- It makes no sense to add additional but useless rules for KB.
- Rules that need to be added are unpredictable.
| # user defined rules | ||
| {{- with .Values.rbac.additionalPolicyRules }} | ||
| {{ toYaml . }} | ||
| {{- end }} |
There was a problem hiding this comment.
Where is this limitation enforced? Is it a restriction within Kubernetes itself, or does KB have validation logic (I can't find the code)?
No description provided.