Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: RBAC Add view, edit and admin roles for BackendConfig #2608

Open
kassah opened this issue Jul 25, 2024 · 0 comments
Open

Feature: RBAC Add view, edit and admin roles for BackendConfig #2608

kassah opened this issue Jul 25, 2024 · 0 comments

Comments

@kassah
Copy link

kassah commented Jul 25, 2024

Right now if you issue edit role on a Namespace, you cannot add BackendConfigs within that namespace by default.

I propose that we add those ClusterRoles in:

This is what I am thinking:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ingress-gce-edit
  labels:
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
  - apiGroups:
      - cloud.google.com
    resources:
      - backendconfigs
    verbs:
      - create
      - delete
      - deletecollection
      - patch
      - update
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ingress-gce-view
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
  - apiGroups:
      - cloud.google.com
    resources:
      - backendconfigs
    verbs:
      - get
      - list
      - watch

I know that EndpointSlices were disabled from edit permission due to possible cross-namespace namespace forwarding. I don't believe this is a problem in BackendConfigs, but someone with experience with the implimentation should confirm. See: kubernetes/kubernetes#103675

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant