Minimize manual creation of manifest files at deployment #50
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: rustyclock <rustyclock@protonmail.com>
Signed-off-by: rustyclock <rustyclock@protonmail.com>
Signed-off-by: rustyclock <rustyclock@protonmail.com>
tkuchiki
reviewed
Nov 8, 2021
| resources: | ||
| - secrets | ||
| verbs: | ||
| - get |
There was a problem hiding this comment.
Suggested change
| - get | |
| - get | |
| resourceNames: | |
| - spanner-autoscaler-service-account |
The downside is that the spanner-autoscaler-controller will have read access to all the secrets.
I have a feeling this will solve the problem. Is there any problem?
There was a problem hiding this comment.
This is a good idea. I have now restricted the default access only the secrets named spanner-autoscaler-gcp-sa.
Thanks for the suggestion!
rustycl0ck
force-pushed
the
rbac-optimize
branch
from
b479e57 to
44b4b92
Compare
* Provide default read access to secret named `spanner-autoscaler-gcp-sa` * Update documentation with the correct secret name and information Signed-off-by: rustyclock <rustyclock@protonmail.com>
rustycl0ck
force-pushed
the
rbac-optimize
branch
from
44b4b92 to
9c105b8
Compare
Signed-off-by: rustyclock <rustyclock@protonmail.com>
rustycl0ck
force-pushed
the
rbac-optimize
branch
from
9c105b8 to
a556f5f
Compare
tkuchiki
reviewed
Nov 15, 2021
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this PR does / Why we need it
ClusterRoleforevents: Provide default access to the controller for publishing events so that a separateRoleandRoleBindingdoes not need to be created separately at the deployment time by the user (through steps provided in README). The current additional step of creating these two resources adds more complexity to the deployment process and does not provide any additional benefits in terms of security.I think that having default permissions to publish events should be fine because it does not grant access to any confidential data like secrets etc.
ClusterRoleforsecrets: The current process for the user is to create a secret, and then additionally create aRole/RoleBindingpair for providing access to controller for that secret. The controller will need access to the secrets if some of the users choose to use the GCP-service-account key for access. So, if we provide the controllerreadaccess to k8ssecrets, it will simplify the deployment process for the user, because they only have to create thesecretand theSpannerAutoscalerCRD then. No more additional custom written yaml files.The downside is that the
spanner-autoscaler-controllerwill havereadaccess toallthe secrets. But I think this permission can not be misused by thespanner-autoscaler-controlleras is visible from the source code that it will try to read only the secret name which is provided in theSpannerAutoscalerCRD. And more advanced users will anyways create their own manifest files for deployment, and can remove access toe secrets in the clusterrole.I think it would be better to keep the default
readaccess tosecrets(for majority of the users). And we can add a note about how advanced users can choose to not provide this access by modifying the default RBAC files. Let me know what you think about this.