Merge pull request #54329 from bsalamat/sched_permission

Automatic merge from submit-queue (batch tested with PRs 52747, 54329). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Fix scheduler permissions to be able to patch pods/status Add "patch" to the list of default operations that kube-scheduler can perform on pods. In 1.8, kube-scheduler was setting annotations via pod/status update, but later it was changed to patch pods. This PR changes default RBAC permissions of kube-scheduler so that it can set annotations of pods. ```release-note NONE ``` /sig scheduling

Merge pull request #54329 from bsalamat/sched_permission
b3284617 · Kubernetes Submit Queue · GitHub · c1925d49 · ffa9ed60 · b3284617
Commit b3284617 authored Oct 20, 2017 by Kubernetes Submit Queue Committed by GitHub Oct 20, 2017
Showing with 3 additions and 2 deletions

policy.go plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +1 -1

cluster-roles.yaml ...thorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml +1 -0

factory.go plugin/pkg/scheduler/factory/factory.go +1 -1

No files found.
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
@@ -357,7 +357,7 @@ func ClusterRoles() []rbac.ClusterRole {
 				rbac.NewRule(Read...).Groups(legacyGroup).Resources("nodes").RuleOrDie(),
 				rbac.NewRule("get", "list", "watch", "delete").Groups(legacyGroup).Resources("pods").RuleOrDie(),
 				rbac.NewRule("create").Groups(legacyGroup).Resources("pods/binding", "bindings").RuleOrDie(),
-				rbac.NewRule("update").Groups(legacyGroup).Resources("pods/status").RuleOrDie(),
+				rbac.NewRule("patch", "update").Groups(legacyGroup).Resources("pods/status").RuleOrDie(),
 				// things that select pods
 				rbac.NewRule(Read...).Groups(legacyGroup).Resources("services", "replicationcontrollers").RuleOrDie(),
 				rbac.NewRule(Read...).Groups(appsGroup, extensionsGroup).Resources("replicasets").RuleOrDie(),

--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
@@ -639,6 +639,7 @@ items:
    resources:
    - pods/status
    verbs:
+    - patch
    - update
  - apiGroups:
    - ""

--- a/plugin/pkg/scheduler/factory/factory.go
+++ b/plugin/pkg/scheduler/factory/factory.go
@@ -1067,6 +1067,6 @@ func (p *podPreemptor) UpdatePodAnnotations(pod *v1.Pod, annotations map[string]
 	if err != nil {
 		return err
 	}
-	_, error := p.Client.CoreV1().Pods(podCopy.Namespace).Patch(podCopy.Name, types.MergePatchType, patchData)
+	_, error := p.Client.CoreV1().Pods(podCopy.Namespace).Patch(podCopy.Name, types.MergePatchType, patchData, "status")
 	return error
 }