Merge pull request #42351 from liggitt/scheduler-statefulset

Automatic merge from submit-queue (batch tested with PRs 41919, 41149, 42350, 42351, 42285) Add read permissions for statefulsets for kube-scheduler https://github.com/kubernetes/kubernetes/issues/41708 added statefulset awareness to the scheduler. This adds the corresponding permission to the scheduler role.

Merge pull request #42351 from liggitt/scheduler-statefulset
346c0ba9 · Kubernetes Submit Queue · GitHub · b432e137 · 4525e042 · 346c0ba9
Commit 346c0ba9 authored Mar 03, 2017 by Kubernetes Submit Queue Committed by GitHub Mar 03, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 9 additions and 0 deletions

policy.go plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +1 -0

cluster-roles.yaml ...thorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml +8 -0

No files found.
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
@@ -351,6 +351,7 @@ func ClusterRoles() []rbac.ClusterRole {
 				// things that select pods
 				rbac.NewRule(Read...).Groups(legacyGroup).Resources("services", "replicationcontrollers").RuleOrDie(),
 				rbac.NewRule(Read...).Groups(extensionsGroup).Resources("replicasets").RuleOrDie(),
+				rbac.NewRule(Read...).Groups(appsGroup).Resources("statefulsets").RuleOrDie(),
 				// things that pods use
 				rbac.NewRule(Read...).Groups(legacyGroup).Resources("persistentvolumeclaims", "persistentvolumes").RuleOrDie(),
 			},

--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
@@ -646,6 +646,14 @@ items:
    - list
    - watch
  - apiGroups:
+    - apps
+    resources:
+    - statefulsets
+    verbs:
+    - get
+    - list
+    - watch
+  - apiGroups:
    - ""
    resources:
    - persistentvolumeclaims