Skip to content

Commit e13398a

Browse files
leifmadsenleifmadsen
authored
Create separate ServiceAccount for Smart Gateways (#119) (#120)
Create a separate ServiceAccount for use by the Smart Gateway workloads. This requires changes to the Operator RBAC permissions so that it can create ClusterRoles, ClusterRoleBindings, and ServiceAcccounts. Implement Ansible changes to the smartgateway role so that the appropriate resources are created in the cluster, and assigned the RBAC permissions to the Smart Gateway workload. Move the Deployment of Smart Gateways from using the default ServiceAccount, and instead use the new smart-gateway ServiceAccount. Signed-off-by: Leif Madsen <[email protected]> Resolves: rhbz#2082310
1 parent da8845c commit e13398a

File tree

7 files changed

+257
-10
lines changed

7 files changed

+257
-10
lines changed

‎deploy/olm-catalog/smart-gateway-operator/manifests/smart-gateway-operator.clusterserviceversion.yaml

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,78 @@ spec:
127127
mediatype: image/svg+xml
128128
install:
129129
spec:
130+
clusterPermissions:
131+
- rules:
132+
- apiGroups:
133+
- authentication.k8s.io
134+
resources:
135+
- tokenreviews
136+
verbs:
137+
- create
138+
- apiGroups:
139+
- authorization.k8s.io
140+
resources:
141+
- subjectaccessreviews
142+
verbs:
143+
- create
144+
- apiGroups:
145+
- rbac.authorization.k8s.io
146+
resources:
147+
- roles
148+
verbs:
149+
- create
150+
- list
151+
- get
152+
- update
153+
- patch
154+
- watch
155+
- apiGroups:
156+
- rbac.authorization.k8s.io
157+
resources:
158+
- clusterroles
159+
verbs:
160+
- create
161+
- list
162+
- get
163+
- update
164+
- patch
165+
- watch
166+
- apiGroups:
167+
- rbac.authorization.k8s.io
168+
resources:
169+
- clusterrolebindings
170+
verbs:
171+
- create
172+
- list
173+
- get
174+
- update
175+
- patch
176+
- watch
177+
- apiGroups:
178+
- ""
179+
resources:
180+
- namespaces
181+
verbs:
182+
- get
183+
- list
184+
- watch
185+
- apiGroups:
186+
- rbac.authorization.k8s.io
187+
resources:
188+
- rolebindings
189+
verbs:
190+
- get
191+
- list
192+
- watch
193+
- apiGroups:
194+
- ""
195+
resources:
196+
- events
197+
verbs:
198+
- create
199+
- patch
200+
- update
201+
serviceAccountName: smart-gateway-operator
130202
deployments:
131203
- name: smart-gateway-operator
132204
spec:
@@ -186,6 +258,7 @@ spec:
186258
- events
187259
- configmaps
188260
- secrets
261+
- serviceaccounts
189262
verbs:
190263
- create
191264
- delete
@@ -249,6 +322,28 @@ spec:
249322
- patch
250323
- update
251324
- watch
325+
- apiGroups:
326+
- rbac.authorization.k8s.io
327+
resources:
328+
- rolebindings
329+
verbs:
330+
- create
331+
- apiGroups:
332+
- ""
333+
resources:
334+
- namespaces
335+
verbs:
336+
- get
337+
- list
338+
- watch
339+
- apiGroups:
340+
- rbac.authorization.k8s.io
341+
resources:
342+
- rolebindings
343+
verbs:
344+
- get
345+
- list
346+
- watch
252347
serviceAccountName: smart-gateway-operator
253348
strategy: deployment
254349
installModes:

‎deploy/role.yaml

Lines changed: 99 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,81 @@
11
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: smart-gateway-operator
5+
rules:
6+
- apiGroups:
7+
- authentication.k8s.io
8+
resources:
9+
- tokenreviews
10+
verbs:
11+
- create
12+
- apiGroups:
13+
- authorization.k8s.io
14+
resources:
15+
- subjectaccessreviews
16+
verbs:
17+
- create
18+
- apiGroups:
19+
- rbac.authorization.k8s.io
20+
resources:
21+
- roles
22+
verbs:
23+
- create
24+
- list
25+
- get
26+
- update
27+
- patch
28+
- watch
29+
- apiGroups:
30+
- rbac.authorization.k8s.io
31+
resources:
32+
- clusterroles
33+
verbs:
34+
- create
35+
- list
36+
- get
37+
- update
38+
- patch
39+
- watch
40+
- apiGroups:
41+
- rbac.authorization.k8s.io
42+
resources:
43+
- clusterrolebindings
44+
verbs:
45+
- create
46+
- list
47+
- get
48+
- update
49+
- patch
50+
- watch
51+
- apiGroups:
52+
- ""
53+
resources:
54+
- namespaces
55+
verbs:
56+
- get
57+
- list
58+
- watch
59+
- apiGroups:
60+
- rbac.authorization.k8s.io
61+
resources:
62+
- rolebindings
63+
verbs:
64+
- get
65+
- list
66+
- watch
67+
- apiGroups:
68+
- ""
69+
resources:
70+
- events
71+
verbs:
72+
- create
73+
- patch
74+
- update
75+
---
76+
apiVersion: rbac.authorization.k8s.io/v1
277
kind: Role
378
metadata:
4-
creationTimestamp: null
579
name: smart-gateway-operator
680
rules:
781
- apiGroups:
@@ -15,6 +89,7 @@ rules:
1589
- events
1690
- configmaps
1791
- secrets
92+
- serviceaccounts
1893
verbs:
1994
- create
2095
- delete
@@ -78,3 +153,26 @@ rules:
78153
- patch
79154
- update
80155
- watch
156+
- apiGroups:
157+
- rbac.authorization.k8s.io
158+
resources:
159+
- rolebindings
160+
verbs:
161+
- create
162+
- apiGroups:
163+
- ""
164+
resources:
165+
- namespaces
166+
verbs:
167+
- get
168+
- list
169+
- watch
170+
- apiGroups:
171+
- rbac.authorization.k8s.io
172+
resources:
173+
- rolebindings
174+
verbs:
175+
- get
176+
- list
177+
- watch
178+

‎deploy/role_binding.yaml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
1-
kind: RoleBinding
1+
kind: ClusterRoleBinding
22
apiVersion: rbac.authorization.k8s.io/v1
33
metadata:
44
name: smart-gateway-operator
55
subjects:
66
- kind: ServiceAccount
77
name: smart-gateway-operator
8+
namespace: service-telemetry
89
roleRef:
9-
kind: Role
10+
kind: ClusterRole
1011
name: smart-gateway-operator
1112
apiGroup: rbac.authorization.k8s.io
1213
---
14+
kind: RoleBinding
1315
apiVersion: rbac.authorization.k8s.io/v1
14-
kind: ClusterRoleBinding
1516
metadata:
16-
name: smart-gateway-auth-delegator
17+
name: smart-gateway-operator
1718
subjects:
1819
- kind: ServiceAccount
19-
name: default
20-
namespace: placeholder
20+
name: smart-gateway-operator
2121
roleRef:
22+
kind: Role
23+
name: smart-gateway-operator
2224
apiGroup: rbac.authorization.k8s.io
23-
kind: ClusterRole
24-
name: system:auth-delegator

‎roles/smartgateway/defaults/main.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ tls_secret_name: elasticsearch-es-cert
99
exporter_host: 0.0.0.0
1010
exporter_port: 8081
1111
block_event_bus: false
12+
service_account_name: smart-gateway
1213

1314
# - This image works on OCP 4.6, 4.7, and 4.8
1415
oauth_proxy_image: image-registry.openshift-image-registry.svc:5000/openshift/oauth-proxy:v4.4

‎roles/smartgateway/tasks/main.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,41 @@
4444
session_secret: "{{ lookup('password', '/dev/null') }}"
4545
when: session_secret.resources|length == 0
4646

47+
- name: Create Smart Gateway ServiceAccount
48+
k8s:
49+
state: present
50+
definition:
51+
apiVersion: v1
52+
kind: ServiceAccount
53+
metadata:
54+
name: "{{ service_account_name }}"
55+
namespace: "{{ meta.namespace }}"
56+
57+
- name: Create Smart Gateway Role
58+
k8s:
59+
state: present
60+
definition: "{{ lookup('template', 'sg-role.yaml.j2') | from_yaml }}"
61+
62+
- name: Create Smart Gateway RoleBinding
63+
k8s:
64+
definition:
65+
apiVersion: rbac.authorization.k8s.io/v1
66+
kind: ClusterRoleBinding
67+
metadata:
68+
labels:
69+
app.kubernetes.io/component: smart-gateway
70+
app.kubernetes.io/name: smart-gateway
71+
app.kubernetes.io/part-of: service-telemetry-framework
72+
name: smart-gateway
73+
roleRef:
74+
apiGroup: rbac.authorization.k8s.io
75+
kind: ClusterRole
76+
name: smart-gateway
77+
subjects:
78+
- kind: ServiceAccount
79+
name: smart-gateway
80+
namespace: "{{ meta.namespace }}"
81+
4782
# used as part of the Deployment object in order to trigger pod restarts on ConfigMap change
4883
- name: Get Smart Gateway ConfigMap Environment
4984
set_fact:

‎roles/smartgateway/templates/deployment.yaml.j2

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ spec:
3434
- -tls-cert=/etc/tls/private/tls.crt
3535
- -tls-key=/etc/tls/private/tls.key
3636
- -cookie-secret-file=/etc/proxy/secrets/session_secret
37-
- -openshift-service-account=NA
37+
- -openshift-service-account={{ service_account_name }}
3838
- -upstream=http://localhost:8081/
3939
- '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
4040
ports:
@@ -136,6 +136,7 @@ spec:
136136
{% endfor %}
137137
{% endif %}
138138
{% endif %}
139+
serviceAccountName: {{ service_account_name }}
139140
volumes:
140141
{% if (applications | selectattr('name','equalto','prometheus') | list | count > 0) %}
141142
- name: {{ meta.name }}-proxy-tls

‎roles/smartgateway/templates/sg-role.yaml.j2

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: smart-gateway
5+
rules:
6+
- apiGroups:
7+
- authentication.k8s.io
8+
resources:
9+
- tokenreviews
10+
verbs:
11+
- create
12+
- apiGroups:
13+
- authorization.k8s.io
14+
resources:
15+
- subjectaccessreviews
16+
verbs:
17+
- create

0 commit comments

Comments
 (0)