Merge pull request #62336 from deads2k/rbac-05-scale

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. add statefulset scaling permission to admins, editors, and viewers StatefulSets are missing scale permissions, so users can't scale them. ```release-note fix permissions to allow statefulset scaling for admins, editors, and viewers ```

Merge pull request #62336 from deads2k/rbac-05-scale
fc752753 · Kubernetes Submit Queue · GitHub · 2bfe40a1 · d280c115 · fc752753
Unverified Commit fc752753 authored Apr 20, 2018 by Kubernetes Submit Queue Committed by GitHub Apr 20, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 9 additions and 3 deletions

policy.go plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +6 -3

cluster-roles.yaml ...thorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml +3 -0

No files found.
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
@@ -236,7 +236,8 @@ func ClusterRoles() []rbac.ClusterRole {
 				rbac.NewRule(Read...).Groups(legacyGroup).Resources("namespaces").RuleOrDie(),
 				rbac.NewRule("impersonate").Groups(legacyGroup).Resources("serviceaccounts").RuleOrDie(),

-				rbac.NewRule(ReadWrite...).Groups(appsGroup).Resources("statefulsets",
+				rbac.NewRule(ReadWrite...).Groups(appsGroup).Resources(
+					"statefulsets", "statefulsets/scale",
 					"daemonsets",
 					"deployments", "deployments/scale", "deployments/rollback",
 					"replicasets", "replicasets/scale").RuleOrDie(),
@@ -275,7 +276,8 @@ func ClusterRoles() []rbac.ClusterRole {
 				rbac.NewRule(Read...).Groups(legacyGroup).Resources("namespaces").RuleOrDie(),
 				rbac.NewRule("impersonate").Groups(legacyGroup).Resources("serviceaccounts").RuleOrDie(),

-				rbac.NewRule(ReadWrite...).Groups(appsGroup).Resources("statefulsets",
+				rbac.NewRule(ReadWrite...).Groups(appsGroup).Resources(
+					"statefulsets", "statefulsets/scale",
 					"daemonsets",
 					"deployments", "deployments/scale", "deployments/rollback",
 					"replicasets", "replicasets/scale").RuleOrDie(),
@@ -307,7 +309,8 @@ func ClusterRoles() []rbac.ClusterRole {
 				// indicator of which namespaces you have access to.
 				rbac.NewRule(Read...).Groups(legacyGroup).Resources("namespaces").RuleOrDie(),

-				rbac.NewRule(Read...).Groups(appsGroup).Resources("statefulsets",
+				rbac.NewRule(Read...).Groups(appsGroup).Resources(
+					"statefulsets", "statefulsets/scale",
 					"daemonsets",
 					"deployments", "deployments/scale",
 					"replicasets", "replicasets/scale").RuleOrDie(),

--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
@@ -137,6 +137,7 @@ items:
    - replicasets
    - replicasets/scale
    - statefulsets
+    - statefulsets/scale
    verbs:
    - create
    - delete
@@ -329,6 +330,7 @@ items:
    - replicasets
    - replicasets/scale
    - statefulsets
+    - statefulsets/scale
    verbs:
    - create
    - delete
@@ -471,6 +473,7 @@ items:
    - replicasets
    - replicasets/scale
    - statefulsets
+    - statefulsets/scale
    verbs:
    - get
    - list