mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-19 19:01:42 +00:00
Josh Siviour
68eeff069e
AssociateAccessPolicy recorded a policy association but never granted it in the cluster. Bake static ClusterRoleBindings for the mulga: groups into the eks-node image, project a principal's cluster-scoped associated policies onto those groups in the TokenReview webhook, and reject namespace scope at association time since there is no namespace-scoped RBAC writer.
51 lines
1.4 KiB
YAML
51 lines
1.4 KiB
YAML
# Static ClusterRoleBindings for the three AWS-managed EKS access policies
|
|
# that have no default Kubernetes binding. AmazonEKSClusterAdminPolicy needs
|
|
# no entry here: it maps to system:masters, which Kubernetes already binds to
|
|
# cluster-admin. These exist from first boot, independent of any cluster or
|
|
# access-entry association, so AssociateAccessPolicy's group projection has
|
|
# something to bind to as soon as it names one of these groups.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: mulga-eks-admin
|
|
labels:
|
|
app.kubernetes.io/managed-by: spinifex-eks
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Group
|
|
name: "mulga:eks-admin"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: admin
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: mulga-eks-edit
|
|
labels:
|
|
app.kubernetes.io/managed-by: spinifex-eks
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Group
|
|
name: "mulga:eks-edit"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: edit
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: mulga-eks-view
|
|
labels:
|
|
app.kubernetes.io/managed-by: spinifex-eks
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Group
|
|
name: "mulga:eks-view"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: view
|