nic-6443 commented on issue #719:
URL:
https://github.com/apache/apisix-ingress-controller/issues/719#issuecomment-962382087
> AFAIK, a ServiceAccount cannot bind to a ClusterRole and a Role at the
same while, we need ClusterRole since we need to watch a few namespaces. So
It's tough to be restrictive about the `lease` resource just by the native RBAC
implementation, maybe you can resort to tools like OpenPolicyAgent to add extra
policies to restrict the behaviors for `lease`.
I verified that sa can bind clusterrole and role at the same time, this is
the test manifests I used:
```
apiVersion: v1
kind: Namespace
metadata:
name: rbac
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: test
namespace: rbac
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: test-clusterrole
rules:
- apiGroups:
- ""
resources:
- endpoints
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: test-role
namespace: rbac
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: test-clusterrolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: test-clusterrole
subjects:
- kind: ServiceAccount
name: test
namespace: rbac
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: test-rolebinding
namespace: rbac
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: test-role
subjects:
- kind: ServiceAccount
name: test
namespace: rbac
```
commands to verify permissions:
```
➜ rbac kubectl auth can-i get endpoints
--as=system:serviceaccount:rbac:test
yes
➜ rbac kubectl auth can-i get configmaps -n rbac
--as=system:serviceaccount:rbac:test
yes
➜ rbac kubectl auth can-i get configmaps
--as=system:serviceaccount:rbac:test
no
```
So maybe we can reconsider the rbac permission for lease
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
