Skip to content

K
k3s
Unverified Commit ec434662 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #64503 from kgolab/kg-ca-rbac

Automatic merge from submit-queue (batch tested with PRs 64503, 64903, 64643, 64987). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Create system:cluster-autoscaler account & role and introduce it to C… **What this PR does / why we need it**: This PR adds cluster-autoscaler ClusterRole & binding, to be used by the Cluster Autoscaler (kubernetes/autoscaler repository). It also updates GCE scripts to make CA use the cluster-autoscaler user account. User account instead of Service account is chosen to be more in line with kube-scheduler. **Which issue(s) this PR fixes**: Fixes [issue 383](https://github.com/kubernetes/autoscaler/issues/383) from kubernetes/autoscaler. **Special notes for your reviewer**: This PR might be treated as a security fix since prior to it CA on GCE was using system:cluster-admin account, assumed due to default handling of unsecured & unauthenticated traffic over plain HTTP. **Release note**: ```release-note A cluster-autoscaler ClusterRole is added to cover only the functionality required by Cluster Autoscaler and avoid abusing system:cluster-admin role. action required: Cloud providers other than GCE might want to update their deployments or sample yaml files to reuse the role created via add-on. ```
parents de8cc313 9e2fa69d
Show whitespace changes
Inline Side-by-side
Showing with 112 additions and 2 deletions
cluster/addons/rbac/cluster-autoscaler/cluster-autoscaler-rbac.yaml 0 → 100644
View file @ ec434662
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: cluster-autoscaler
labels:
addonmanager.kubernetes.io/mode: Reconcile
rules:
# leader election
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["create"]
- apiGroups: [""]
resources: ["endpoints"]
resourceNames: ["cluster-autoscaler"]
verbs: ["get", "update", "patch", "delete"]
# accessing & modifying cluster state (nodes & pods)
- apiGroups: [""]
resources: ["nodes"]
verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["pods/eviction"]
verbs: ["create"]
# read-only access to cluster state
- apiGroups: [""]
resources: ["services", "replicationcontrollers", "persistentvolumes", "persistentvolumeclaims"]
verbs: ["get", "list", "watch"]
- apiGroups: ["apps", "extensions"]
resources: ["daemonsets", "replicasets"]
verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
resources: ["statefulsets"]
verbs: ["get", "list", "watch"]
- apiGroups: ["policy"]
resources: ["poddisruptionbudgets"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
# misc access
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["create"]
- apiGroups: [""]
resources: ["configmaps"]
resourceNames: ["cluster-autoscaler-status"]
verbs: ["get", "update", "patch", "delete"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: cluster-autoscaler
labels:
addonmanager.kubernetes.io/mode: Reconcile
subjects:
- kind: User
name: cluster-autoscaler
namespace: kube-system
roleRef:
kind: ClusterRole
name: cluster-autoscaler
apiGroup: rbac.authorization.k8s.io
cluster/gce/gci/configure-helper.sh
View file @ ec434662
...@@ -545,6 +545,9 @@ function create-master-auth { ...@@ -545,6 +545,9 @@ function create-master-auth {
if [[ -n "${KUBE_SCHEDULER_TOKEN:-}" ]]; then if [[ -n "${KUBE_SCHEDULER_TOKEN:-}" ]]; then
append_or_replace_prefixed_line "${known_tokens_csv}" "${KUBE_SCHEDULER_TOKEN}," "system:kube-scheduler,uid:system:kube-scheduler" append_or_replace_prefixed_line "${known_tokens_csv}" "${KUBE_SCHEDULER_TOKEN}," "system:kube-scheduler,uid:system:kube-scheduler"
fi fi
if [[ -n "${KUBE_CLUSTER_AUTOSCALER_TOKEN:-}" ]]; then
append_or_replace_prefixed_line "${known_tokens_csv}" "${KUBE_CLUSTER_AUTOSCALER_TOKEN}," "cluster-autoscaler,uid:cluster-autoscaler"
fi
if [[ -n "${KUBE_PROXY_TOKEN:-}" ]]; then if [[ -n "${KUBE_PROXY_TOKEN:-}" ]]; then
append_or_replace_prefixed_line "${known_tokens_csv}" "${KUBE_PROXY_TOKEN}," "system:kube-proxy,uid:kube_proxy" append_or_replace_prefixed_line "${known_tokens_csv}" "${KUBE_PROXY_TOKEN}," "system:kube-proxy,uid:kube_proxy"
fi fi
...@@ -1006,6 +1009,30 @@ current-context: kube-scheduler ...@@ -1006,6 +1009,30 @@ current-context: kube-scheduler
EOF EOF
} }
function create-clusterautoscaler-kubeconfig {
echo "Creating cluster-autoscaler kubeconfig file"
mkdir -p /etc/srv/kubernetes/cluster-autoscaler
cat <<EOF >/etc/srv/kubernetes/cluster-autoscaler/kubeconfig
apiVersion: v1
kind: Config
users:
- name: cluster-autoscaler
user:
token: ${KUBE_CLUSTER_AUTOSCALER_TOKEN}
clusters:
- name: local
cluster:
insecure-skip-tls-verify: true
server: https://localhost:443
contexts:
- context:
cluster: local
user: cluster-autoscaler
name: cluster-autoscaler
current-context: cluster-autoscaler
EOF
}
function create-kubescheduler-policy-config { function create-kubescheduler-policy-config {
echo "Creating kube-scheduler policy config file" echo "Creating kube-scheduler policy config file"
mkdir -p /etc/srv/kubernetes/kube-scheduler mkdir -p /etc/srv/kubernetes/kube-scheduler
...@@ -1978,12 +2005,15 @@ function start-kube-scheduler { ...@@ -1978,12 +2005,15 @@ function start-kube-scheduler {
function start-cluster-autoscaler { function start-cluster-autoscaler {
if [[ "${ENABLE_CLUSTER_AUTOSCALER:-}" == "true" ]]; then if [[ "${ENABLE_CLUSTER_AUTOSCALER:-}" == "true" ]]; then
echo "Start kubernetes cluster autoscaler" echo "Start kubernetes cluster autoscaler"
setup-addon-manifests "addons" "rbac/cluster-autoscaler"
create-clusterautoscaler-kubeconfig
prepare-log-file /var/log/cluster-autoscaler.log prepare-log-file /var/log/cluster-autoscaler.log
# Remove salt comments and replace variables with values # Remove salt comments and replace variables with values
local -r src_file="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/cluster-autoscaler.manifest" local -r src_file="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/cluster-autoscaler.manifest"
local params="${AUTOSCALER_MIG_CONFIG} ${CLOUD_CONFIG_OPT} ${AUTOSCALER_EXPANDER_CONFIG:---expander=price}" local params="${AUTOSCALER_MIG_CONFIG} ${CLOUD_CONFIG_OPT} ${AUTOSCALER_EXPANDER_CONFIG:---expander=price}"
params+=" --kubeconfig=/etc/srv/kubernetes/cluster-autoscaler/kubeconfig"
sed -i -e "s@{{params}}@${params}@g" "${src_file}" sed -i -e "s@{{params}}@${params}@g" "${src_file}"
sed -i -e "s@{{cloud_config_mount}}@${CLOUD_CONFIG_MOUNT}@g" "${src_file}" sed -i -e "s@{{cloud_config_mount}}@${CLOUD_CONFIG_MOUNT}@g" "${src_file}"
sed -i -e "s@{{cloud_config_volume}}@${CLOUD_CONFIG_VOLUME}@g" "${src_file}" sed -i -e "s@{{cloud_config_volume}}@${CLOUD_CONFIG_VOLUME}@g" "${src_file}"
...@@ -2595,9 +2625,10 @@ function main() { ...@@ -2595,9 +2625,10 @@ function main() {
fi fi
fi fi
# generate the controller manager and scheduler tokens here since they are only used on the master. # generate the controller manager, scheduler and cluster autoscaler tokens here since they are only used on the master.
KUBE_CONTROLLER_MANAGER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null) KUBE_CONTROLLER_MANAGER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
KUBE_SCHEDULER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null) KUBE_SCHEDULER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
KUBE_CLUSTER_AUTOSCALER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
setup-os-params setup-os-params
config-ip-firewall config-ip-firewall
......
cluster/gce/manifests/cluster-autoscaler.manifest
View file @ ec434662
...@@ -28,7 +28,7 @@ ...@@ -28,7 +28,7 @@
}, },
"command": [ "command": [
"./run.sh", "./run.sh",
"--kubernetes=http://127.0.0.1:8080?inClusterConfig=f", "--kubernetes=https://127.0.0.1:443",
"--v=4", "--v=4",
"--logtostderr=true", "--logtostderr=true",
"--write-status-configmap=true", "--write-status-configmap=true",
...@@ -60,6 +60,11 @@ ...@@ -60,6 +60,11 @@
"mountPath": "/usr/share/ca-certificates" "mountPath": "/usr/share/ca-certificates"
}, },
{ {
"name": "srvkube",
"readOnly": true,
"mountPath": "/etc/srv/kubernetes/cluster-autoscaler"
},
{
"name": "logfile", "name": "logfile",
"mountPath": "/var/log/cluster-autoscaler.log", "mountPath": "/var/log/cluster-autoscaler.log",
"readOnly": false "readOnly": false
...@@ -84,6 +89,12 @@ ...@@ -84,6 +89,12 @@
} }
}, },
{ {
"name": "srvkube",
"hostPath": {
"path": "/etc/srv/kubernetes/cluster-autoscaler"
}
},
{
"name": "logfile", "name": "logfile",
"hostPath": { "hostPath": {
"path": "/var/log/cluster-autoscaler.log", "path": "/var/log/cluster-autoscaler.log",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment