Skip to content

Commit f84e759

Browse files
alebedev87alebedev87
committed
OCPBUGS-31353: Minimize wildcard privileges
- Added operand namespaces in the operator payload to be able to create local roles. - Added local roles and rolebinding in the operand namespaces to manage ingresscontrollers and canary. - Limited cluster permissions on secret and configmap to resource names required for the certificate management. - Limited cluster permissions on namespace resource to operand namespaces. TODO: clusterroles/clusterrolebinding and roles/rolebindings.
1 parent edf5e71 commit f84e759

File tree

4 files changed

+170
-12
lines changed

4 files changed

+170
-12
lines changed

‎manifests/00-cluster-role.yaml

Lines changed: 32 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,39 +14,59 @@ rules:
1414
- apiGroups:
1515
- ""
1616
resources:
17-
- configmaps
18-
- namespaces
19-
- serviceaccounts
2017
- endpoints
2118
- services
22-
- secrets
2319
- pods
2420
- events
2521
verbs:
2622
- "*"
2723

24+
# Operand namespaces.
2825
- apiGroups:
2926
- ""
3027
resources:
31-
- pods/eviction
28+
- namespaces
29+
resourceNames:
30+
- openshift-ingress
31+
- openshift-ingress-canary
3232
verbs:
33-
- "create"
33+
- "*"
3434

35+
# Rules to manage router certificates.
36+
# The required secret and configmap reside in openshift-config-managed namespace
37+
# which does not exist at the moment of the operator installation.
38+
# Therefore the rules are in the cluster scope.
3539
- apiGroups:
3640
- ""
3741
resources:
38-
- nodes
42+
- secrets
43+
resourceNames:
44+
- router-certs
3945
verbs:
40-
- list
41-
46+
- "*"
4247
- apiGroups:
43-
- apps
48+
- ""
4449
resources:
45-
- deployments
46-
- daemonsets
50+
- configmaps
51+
resourceNames:
52+
- default-ingress-cert
4753
verbs:
4854
- "*"
4955

56+
- apiGroups:
57+
- ""
58+
resources:
59+
- pods/eviction
60+
verbs:
61+
- "create"
62+
63+
- apiGroups:
64+
- ""
65+
resources:
66+
- nodes
67+
verbs:
68+
- list
69+
5070
- apiGroups:
5171
- policy
5272
resources:

‎manifests/00-operand-namespace.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Define operand namespaces to be able to restrict the operator's RBAC permissions.
2+
# This enables limiting the access to sensitive resources (e.g., Secrets, ServiceAccounts, ConfigMaps)
3+
# from cluster-wide scope to specific namespaces.
4+
---
5+
kind: Namespace
6+
apiVersion: v1
7+
metadata:
8+
annotations:
9+
capability.openshift.io/name: Ingress
10+
include.release.openshift.io/ibm-cloud-managed: "true"
11+
include.release.openshift.io/self-managed-high-availability: "true"
12+
include.release.openshift.io/single-node-developer: "true"
13+
openshift.io/node-selector: ""
14+
workload.openshift.io/allowed: "management"
15+
labels:
16+
# allow openshift-monitoring to look for ServiceMonitor objects in this namespace
17+
openshift.io/cluster-monitoring: "true"
18+
name: openshift-ingress
19+
# old and new forms of the label for matching with NetworkPolicy
20+
network.openshift.io/policy-group: ingress
21+
policy-group.network.openshift.io/ingress: ""
22+
# Router deployment needs to allow privilege escalation, as well as host
23+
# network and host ports for the "HostNetwork" endpoint publishing strategy,
24+
# which is the default for on-premise platforms.
25+
pod-security.kubernetes.io/enforce: privileged
26+
pod-security.kubernetes.io/audit: privileged
27+
pod-security.kubernetes.io/warn: privileged
28+
name: openshift-ingress
29+
---
30+
kind: Namespace
31+
apiVersion: v1
32+
metadata:
33+
annotations:
34+
capability.openshift.io/name: Ingress
35+
include.release.openshift.io/ibm-cloud-managed: "true"
36+
include.release.openshift.io/self-managed-high-availability: "true"
37+
include.release.openshift.io/single-node-developer: "true"
38+
openshift.io/node-selector: ""
39+
workload.openshift.io/allowed: "management"
40+
name: openshift-ingress-canary

‎manifests/01-role-binding.yaml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,45 @@ roleRef:
3838
kind: Role
3939
apiGroup: rbac.authorization.k8s.io
4040
name: ingress-operator
41+
---
42+
# RoleBinding for the operator to manage ingresscontrollers
43+
# in the openshift-ingress namespace.
44+
kind: RoleBinding
45+
apiVersion: rbac.authorization.k8s.io/v1
46+
metadata:
47+
name: ingress-operator
48+
namespace: openshift-ingress
49+
annotations:
50+
capability.openshift.io/name: Ingress
51+
include.release.openshift.io/ibm-cloud-managed: "true"
52+
include.release.openshift.io/self-managed-high-availability: "true"
53+
include.release.openshift.io/single-node-developer: "true"
54+
subjects:
55+
- kind: ServiceAccount
56+
name: ingress-operator
57+
namespace: openshift-ingress-operator
58+
roleRef:
59+
kind: Role
60+
apiGroup: rbac.authorization.k8s.io
61+
name: ingress-operator
62+
---
63+
# RoleBinding for the operator to manage canary deployment
64+
# in the openshift-ingress-canary namespace.
65+
kind: RoleBinding
66+
apiVersion: rbac.authorization.k8s.io/v1
67+
metadata:
68+
name: ingress-operator
69+
namespace: openshift-ingress-canary
70+
annotations:
71+
capability.openshift.io/name: Ingress
72+
include.release.openshift.io/ibm-cloud-managed: "true"
73+
include.release.openshift.io/self-managed-high-availability: "true"
74+
include.release.openshift.io/single-node-developer: "true"
75+
subjects:
76+
- kind: ServiceAccount
77+
name: ingress-operator
78+
namespace: openshift-ingress-operator
79+
roleRef:
80+
kind: Role
81+
apiGroup: rbac.authorization.k8s.io
82+
name: ingress-operator

‎manifests/01-role.yaml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,59 @@ rules:
5858
- rolebindings
5959
verbs:
6060
- delete
61+
---
62+
# Role for the operator to manage ingress controllers
63+
# in openshift-ingress namespace.
64+
kind: Role
65+
apiVersion: rbac.authorization.k8s.io/v1
66+
metadata:
67+
name: ingress-operator
68+
namespace: openshift-ingress
69+
annotations:
70+
capability.openshift.io/name: Ingress
71+
include.release.openshift.io/ibm-cloud-managed: "true"
72+
include.release.openshift.io/self-managed-high-availability: "true"
73+
include.release.openshift.io/single-node-developer: "true"
74+
rules:
75+
- apiGroups:
76+
- ""
77+
resources:
78+
- secrets
79+
- configmaps
80+
- serviceaccounts
81+
verbs:
82+
- "*"
83+
- apiGroups:
84+
- apps
85+
resources:
86+
- deployments
87+
verbs:
88+
- "*"
89+
---
90+
# Role for the operator to manage canary deployment
91+
# in openshift-ingress-canary namespace.
92+
kind: Role
93+
apiVersion: rbac.authorization.k8s.io/v1
94+
metadata:
95+
name: ingress-operator
96+
namespace: openshift-ingress-canary
97+
annotations:
98+
capability.openshift.io/name: Ingress
99+
include.release.openshift.io/ibm-cloud-managed: "true"
100+
include.release.openshift.io/self-managed-high-availability: "true"
101+
include.release.openshift.io/single-node-developer: "true"
102+
rules:
103+
- apiGroups:
104+
- ""
105+
resources:
106+
- secrets
107+
- configmaps
108+
- serviceaccounts
109+
verbs:
110+
- "*"
111+
- apiGroups:
112+
- apps
113+
resources:
114+
- daemonsets
115+
verbs:
116+
- "*"

0 commit comments

Comments
 (0)