Browse code
Fix group name in EgressNetworkPolicy-related rules
We were adding rules for EgressNetworkPolicy in kapiGroup rather than
sdnGroup. This didn't actually break anything because all of the
groups are currently "", but we should do it right anyway...
Dan Winship authored on 2016/12/16 04:10:19Showing 2 changed files
| ... | ... |
@@ -113,7 +113,7 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
|
| 113 | 113 |
Name: ClusterReaderRoleName, |
| 114 | 114 |
}, |
| 115 | 115 |
Rules: []authorizationapi.PolicyRule{
|
| 116 |
- authorizationapi.NewRule(read...).Groups(kapiGroup).Resources("bindings", "componentstatuses", "configmaps", "egressnetworkpolicies", "endpoints", "events", "limitranges",
|
|
| 116 |
+ authorizationapi.NewRule(read...).Groups(kapiGroup).Resources("bindings", "componentstatuses", "configmaps", "endpoints", "events", "limitranges",
|
|
| 117 | 117 |
"namespaces", "namespaces/status", "nodes", "nodes/status", "persistentvolumeclaims", "persistentvolumeclaims/status", "persistentvolumes", |
| 118 | 118 |
"persistentvolumes/status", "pods", "pods/binding", "pods/eviction", "pods/log", "pods/status", "podtemplates", "replicationcontrollers", "replicationcontrollers/scale", |
| 119 | 119 |
"replicationcontrollers/status", "resourcequotas", "resourcequotas/status", "securitycontextconstraints", "serviceaccounts", "services", |
| ... | ... |
@@ -157,7 +157,7 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
|
| 157 | 157 |
|
| 158 | 158 |
authorizationapi.NewRule(read...).Groups(routeGroup).Resources("routes", "routes/status").RuleOrDie(),
|
| 159 | 159 |
|
| 160 |
- authorizationapi.NewRule(read...).Groups(sdnGroup).Resources("clusternetworks", "hostsubnets", "netnamespaces").RuleOrDie(),
|
|
| 160 |
+ authorizationapi.NewRule(read...).Groups(sdnGroup).Resources("clusternetworks", "egressnetworkpolicies", "hostsubnets", "netnamespaces").RuleOrDie(),
|
|
| 161 | 161 |
|
| 162 | 162 |
authorizationapi.NewRule(read...).Groups(templateGroup).Resources("templates", "templateconfigs", "processedtemplates").RuleOrDie(),
|
| 163 | 163 |
|
| ... | ... |
@@ -644,10 +644,8 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
|
| 644 | 644 |
Name: SDNReaderRoleName, |
| 645 | 645 |
}, |
| 646 | 646 |
Rules: []authorizationapi.PolicyRule{
|
| 647 |
- authorizationapi.NewRule(read...).Groups(sdnGroup).Resources("hostsubnets", "netnamespaces").RuleOrDie(),
|
|
| 647 |
+ authorizationapi.NewRule(read...).Groups(sdnGroup).Resources("egressnetworkpolicies", "hostsubnets", "netnamespaces").RuleOrDie(),
|
|
| 648 | 648 |
authorizationapi.NewRule(read...).Groups(kapiGroup).Resources("nodes", "namespaces").RuleOrDie(),
|
| 649 |
- authorizationapi.NewRule(read...).Groups(kapiGroup).Resources("egressnetworkpolicies").RuleOrDie(),
|
|
| 650 |
- |
|
| 651 | 649 |
authorizationapi.NewRule("get").Groups(sdnGroup).Resources("clusternetworks").RuleOrDie(),
|
| 652 | 650 |
}, |
| 653 | 651 |
}, |
| ... | ... |
@@ -48,7 +48,6 @@ items: |
| 48 | 48 |
- bindings |
| 49 | 49 |
- componentstatuses |
| 50 | 50 |
- configmaps |
| 51 |
- - egressnetworkpolicies |
|
| 52 | 51 |
- endpoints |
| 53 | 52 |
- events |
| 54 | 53 |
- limitranges |
| ... | ... |
@@ -277,6 +276,7 @@ items: |
| 277 | 277 |
attributeRestrictions: null |
| 278 | 278 |
resources: |
| 279 | 279 |
- clusternetworks |
| 280 |
+ - egressnetworkpolicies |
|
| 280 | 281 |
- hostsubnets |
| 281 | 282 |
- netnamespaces |
| 282 | 283 |
verbs: |
| ... | ... |
@@ -2088,6 +2088,7 @@ items: |
| 2088 | 2088 |
- "" |
| 2089 | 2089 |
attributeRestrictions: null |
| 2090 | 2090 |
resources: |
| 2091 |
+ - egressnetworkpolicies |
|
| 2091 | 2092 |
- hostsubnets |
| 2092 | 2093 |
- netnamespaces |
| 2093 | 2094 |
verbs: |
| ... | ... |
@@ -2108,15 +2109,6 @@ items: |
| 2108 | 2108 |
- "" |
| 2109 | 2109 |
attributeRestrictions: null |
| 2110 | 2110 |
resources: |
| 2111 |
- - egressnetworkpolicies |
|
| 2112 |
- verbs: |
|
| 2113 |
- - get |
|
| 2114 |
- - list |
|
| 2115 |
- - watch |
|
| 2116 |
- - apiGroups: |
|
| 2117 |
- - "" |
|
| 2118 |
- attributeRestrictions: null |
|
| 2119 |
- resources: |
|
| 2120 | 2111 |
- clusternetworks |
| 2121 | 2112 |
verbs: |
| 2122 | 2113 |
- get |