Merge pull request #59375 from mikedanese/csr-delete

Automatic merge from submit-queue (batch tested with PRs 55986, 59375, 59334, 59348, 58027). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. certs: allow cert controller to delete csrs This should have been changed as part of #51840. Fixes https://github.com/kubernetes/kubernetes/issues/59351 ```release-note Fix RBAC role for certificate controller to allow cleaning. ```

Merge pull request #59375 from mikedanese/csr-delete
6c8d4d39 · Kubernetes Submit Queue · GitHub · 228b7d5d · e3c5a73f · 6c8d4d39
Unverified Commit 6c8d4d39 authored Feb 05, 2018 by Kubernetes Submit Queue Committed by GitHub Feb 05, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

controller_policy.go ...auth/authorizer/rbac/bootstrappolicy/controller_policy.go +1 -1

controller-roles.yaml ...rizer/rbac/bootstrappolicy/testdata/controller-roles.yaml +1 -0

No files found.
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
@@ -318,7 +318,7 @@ func buildControllerRoles() ([]rbac.ClusterRole, []rbac.ClusterRoleBinding) {
 	addControllerRole(&controllerRoles, &controllerRoleBindings, rbac.ClusterRole{
 		ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "certificate-controller"},
 		Rules: []rbac.PolicyRule{
-			rbac.NewRule("get", "list", "watch").Groups(certificatesGroup).Resources("certificatesigningrequests").RuleOrDie(),
+			rbac.NewRule("get", "list", "watch", "delete").Groups(certificatesGroup).Resources("certificatesigningrequests").RuleOrDie(),
 			rbac.NewRule("update").Groups(certificatesGroup).Resources("certificatesigningrequests/status", "certificatesigningrequests/approval").RuleOrDie(),
 			rbac.NewRule("create").Groups(authorizationGroup).Resources("subjectaccessreviews").RuleOrDie(),
 			eventsRule(),

--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
@@ -73,6 +73,7 @@ items:
    resources:
    - certificatesigningrequests
    verbs:
+    - delete
    - get
    - list
    - watch