Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: rbac permissions for odiglet #2049

Merged
merged 17 commits into from
Dec 23, 2024
Merged

chore: rbac permissions for odiglet #2049

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
f1dfe99
chore(instrumentor): add role and rolebinding
blumamir Dec 20, 2024
9a21316
chore(intrumentor): reduce cluster role permissions
blumamir Dec 20, 2024
73811c2
revert(instrumentor): update and patch for workloads
blumamir Dec 20, 2024
2d5c263
chore(instrumentor): updated rbac permissions in helm template
blumamir Dec 20, 2024
2826fc4
chore: better var name
blumamir Dec 20, 2024
37bc3cb
Merge remote-tracking branch 'upstream/main' into instrumentor-rbac
blumamir Dec 20, 2024
d5e6bef
fix: duplicate cache keys
blumamir Dec 20, 2024
cb3b34e
chore(odiglet): remove unused namespace and service
blumamir Dec 21, 2024
b00cbc0
chore(odiglet): remove deprecated odigosconfiguration permissions
blumamir Dec 21, 2024
9a17e63
chore(odiglet): add rbac role and easy cleanups
blumamir Dec 21, 2024
1bd7144
chore(odiglet): remove usused cm permissions
blumamir Dec 21, 2024
75a1fc9
chore: remove watch rbac permission for workloads
blumamir Dec 21, 2024
edad575
chore: sync helm
blumamir Dec 21, 2024
4d5e637
Merge remote-tracking branch 'upstream/main' into odiglet-rbac
blumamir Dec 21, 2024
4357be3
Merge branch 'main' into odiglet-rbac
blumamir Dec 23, 2024
9cda80d
Merge branch 'main' into odiglet-rbac
blumamir Dec 23, 2024
0a4ed4f
Merge branch 'main' into odiglet-rbac
blumamir Dec 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
175 changes: 70 additions & 105 deletions cli/cmd/resources/odiglet.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (

"github.com/odigos-io/odigos/cli/pkg/autodetect"
cmdcontext "github.com/odigos-io/odigos/cli/pkg/cmd_context"
"github.com/odigos-io/odigos/common/consts"

"github.com/odigos-io/odigos/cli/cmd/resources/odigospro"
"github.com/odigos-io/odigos/cli/cmd/resources/resourcemanager"
Expand All @@ -24,12 +25,16 @@ import (
)

const (
OdigletServiceName = "odiglet"
OdigletDaemonSetName = "odiglet"
OdigletAppLabelValue = "odiglet"
OdigletContainerName = "odiglet"
OdigletImageName = "keyval/odigos-odiglet"
OdigletEnterpriseImageName = "keyval/odigos-enterprise-odiglet"
OdigletDaemonSetName = "odiglet"
OdigletAppLabelValue = OdigletDaemonSetName
OdigletServiceAccountName = OdigletDaemonSetName
OdigletRoleName = OdigletDaemonSetName
OdigletRoleBindingName = OdigletDaemonSetName
OdigletClusterRoleName = OdigletDaemonSetName
OdigletClusterRoleBindingName = OdigletDaemonSetName
OdigletContainerName = "odiglet"
OdigletImageName = "keyval/odigos-odiglet"
OdigletEnterpriseImageName = "keyval/odigos-enterprise-odiglet"
)

func NewOdigletServiceAccount(ns string) *corev1.ServiceAccount {
Expand All @@ -39,20 +44,21 @@ func NewOdigletServiceAccount(ns string) *corev1.ServiceAccount {
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "odiglet",
Name: OdigletServiceAccountName,
Namespace: ns,
},
}
}

func NewOdigletClusterRole(psp bool) *rbacv1.ClusterRole {
clusterrole := &rbacv1.ClusterRole{
func NewOdigletRole(ns string) *rbacv1.Role {
return &rbacv1.Role{
TypeMeta: metav1.TypeMeta{
Kind: "ClusterRole",
Kind: "Role",
APIVersion: "rbac.authorization.k8s.io/v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "odiglet",
Name: OdigletRoleName,
Namespace: ns,
},
Rules: []rbacv1.PolicyRule{
{
Expand All @@ -62,37 +68,57 @@ func NewOdigletClusterRole(psp bool) *rbacv1.ClusterRole {
"watch",
},
APIGroups: []string{"odigos.io"},
Resources: []string{"odigosconfigurations", "collectorsgroups", "collectorsgroups/status"},
},
{
Verbs: []string{
"get",
"list",
"watch",
},
APIGroups: []string{""},
Resources: []string{"configmaps"},
Resources: []string{"collectorsgroups", "collectorsgroups/status"},
},
{
Verbs: []string{
"get",
"list",
"watch",
},
APIGroups: []string{""},
Resources: []string{
"pods",
},
APIGroups: []string{""},
Resources: []string{"configmaps"},
ResourceNames: []string{consts.OdigosConfigurationName},
},
},
}
}

func NewOdigletRoleBinding(ns string) *rbacv1.RoleBinding {
return &rbacv1.RoleBinding{
TypeMeta: metav1.TypeMeta{
Kind: "RoleBinding",
APIVersion: "rbac.authorization.k8s.io/v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: OdigletRoleBindingName,
Namespace: ns,
},
Subjects: []rbacv1.Subject{
{
Verbs: []string{
"get",
},
APIGroups: []string{""},
Resources: []string{
"pods/status",
},
Kind: "ServiceAccount",
Name: OdigletServiceAccountName,
Namespace: ns,
},
},
RoleRef: rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "Role",
Name: OdigletRoleName,
},
}
}

func NewOdigletClusterRole(psp bool) *rbacv1.ClusterRole {
clusterrole := &rbacv1.ClusterRole{
TypeMeta: metav1.TypeMeta{
Kind: "ClusterRole",
APIVersion: "rbac.authorization.k8s.io/v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: OdigletClusterRoleName,
},
Rules: []rbacv1.PolicyRule{
{
Verbs: []string{
"get",
Expand All @@ -101,34 +127,7 @@ func NewOdigletClusterRole(psp bool) *rbacv1.ClusterRole {
},
APIGroups: []string{""},
Resources: []string{
"nodes",
},
},
{
Verbs: []string{
"get",
"list",
"watch",
},
APIGroups: []string{"apps"},
Resources: []string{"deployments"},
},
{
Verbs: []string{
"get",
},
APIGroups: []string{"apps"},
Resources: []string{
"deployments/status",
},
},
{
Verbs: []string{
"get",
},
APIGroups: []string{"apps"},
Resources: []string{
"deployments/finalizers",
"pods", "pods/status",
},
},
{
Expand All @@ -137,25 +136,9 @@ func NewOdigletClusterRole(psp bool) *rbacv1.ClusterRole {
"list",
"watch",
},
APIGroups: []string{"apps"},
Resources: []string{"statefulsets"},
},
{
Verbs: []string{
"get",
},
APIGroups: []string{"apps"},
Resources: []string{
"statefulsets/status",
},
},
{
Verbs: []string{
"get",
},
APIGroups: []string{"apps"},
APIGroups: []string{""},
Resources: []string{
"statefulsets/finalizers",
"nodes",
},
},
{
Expand All @@ -165,24 +148,15 @@ func NewOdigletClusterRole(psp bool) *rbacv1.ClusterRole {
"watch",
},
APIGroups: []string{"apps"},
Resources: []string{"daemonsets"},
},
{
Verbs: []string{
"get",
},
APIGroups: []string{"apps"},
Resources: []string{
"daemonsets/status",
},
Resources: []string{"deployments", "daemonsets", "statefulsets"},
},
{
Verbs: []string{
"get",
},
APIGroups: []string{"apps"},
Resources: []string{
"daemonsets/finalizers",
"deployments/status", "daemonsets/status", "statefulsets/status",
},
},
{
Expand Down Expand Up @@ -253,17 +227,6 @@ func NewOdigletClusterRole(psp bool) *rbacv1.ClusterRole {
"instrumentationinstances/status",
},
},
{
Verbs: []string{
"get",
"list",
"watch",
},
APIGroups: []string{""},
Resources: []string{
"namespaces",
},
},
{
Verbs: []string{
"get",
Expand Down Expand Up @@ -319,19 +282,19 @@ func NewOdigletClusterRoleBinding(ns string) *rbacv1.ClusterRoleBinding {
APIVersion: "rbac.authorization.k8s.io/v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "odiglet",
Name: OdigletClusterRoleBindingName,
},
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: "odiglet",
Name: OdigletServiceAccountName,
Namespace: ns,
},
},
RoleRef: rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "odiglet",
Name: OdigletClusterRoleName,
},
}
}
Expand All @@ -349,7 +312,7 @@ func NewSCCRoleBinding(ns string) *rbacv1.RoleBinding {
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: "odiglet",
Name: OdigletServiceAccountName,
Namespace: ns,
},
{
Expand Down Expand Up @@ -641,7 +604,7 @@ func NewOdigletDaemonSet(ns string, version string, imagePrefix string, imageNam
},
},
DNSPolicy: "ClusterFirstWithHostNet",
ServiceAccountName: "odiglet",
ServiceAccountName: OdigletServiceAccountName,
HostNetwork: true,
HostPID: true,
PriorityClassName: "system-node-critical",
Expand Down Expand Up @@ -723,6 +686,8 @@ func (a *odigletResourceManager) InstallFromScratch(ctx context.Context) error {

resources := []kube.Object{
NewOdigletServiceAccount(a.ns),
NewOdigletRole(a.ns),
NewOdigletRoleBinding(a.ns),
NewOdigletClusterRole(a.config.Psp),
NewOdigletClusterRoleBinding(a.ns),
}
Expand Down
Loading
Loading