Skip to content

K
k3s
Commit 8a4f367c authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #39544 from foxish/fix-rbac-disruption

Automatic merge from submit-queue (batch tested with PRs 39544, 39552, 39553) Allow disruption controller to read statefulsets **What this PR does / why we need it**: Disruption controller was unable to list/watch statefulsets when RBAC is enabled because it wasn't granted permission. **Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubernetes/issues/39541 cc @mwielgus
parents 0bbb49d2 a8a65022
Hide whitespace changes
Inline Side-by-side
Showing with 10 additions and 0 deletions
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
View file @ 8a4f367c
......@@ -108,6 +108,7 @@ func init() {
rbac.NewRule("get", "list", "watch").Groups(extensionsGroup).Resources("replicasets").RuleOrDie(),
rbac.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("replicationcontrollers").RuleOrDie(),
rbac.NewRule("get", "list", "watch").Groups(policyGroup).Resources("poddisruptionbudgets").RuleOrDie(),
rbac.NewRule("get", "list", "watch").Groups(appsGroup).Resources("statefulsets").RuleOrDie(),
rbac.NewRule("update").Groups(policyGroup).Resources("poddisruptionbudgets/status").RuleOrDie(),
eventsRule(),
},
......
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
View file @ 8a4f367c
......@@ -264,6 +264,15 @@ items:
- list
- watch
- apiGroups:
- apps
attributeRestrictions: null
resources:
- statefulsets
verbs:
- get
- list
- watch
- apiGroups:
- policy
attributeRestrictions: null
resources:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment