mirror of
https://github.com/kubernetes/kubernetes.git
synced 2026-06-11 01:41:54 -04:00
adbf3b5aa5
This commit introduces the DRAResourceClaimGranularStatusAuthorization feature gate (Beta in 1.36) to enforce fine-grained authorization checks on ResourceClaim status updates. Previously, 'update' permission on 'resourceclaims/status' allowed modifying the entire status. To enforce the principle of least privilege for DRA drivers and the scheduler, this change introduces synthetic subresources and verb prefixes: - 'resourceclaims/binding': Required to update 'status.allocation' and 'status.reservedFor'. - 'resourceclaims/driver': Required to update 'status.devices'. Evaluated on a per-driver basis using 'associated-node:<verb>' (for node-local ServiceAccounts) or 'arbitrary-node:<verb>' (for cluster-wide controllers).
87 lines
3 KiB
YAML
87 lines
3 KiB
YAML
# Real driver deployments must replace all occurrences of "dra-kubelet-plugin"
|
|
# with something specific to their driver.
|
|
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: dra-kubelet-plugin-service-account
|
|
namespace: dra-kubelet-plugin-namespace
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: dra-kubelet-plugin-role
|
|
rules:
|
|
- apiGroups: ["resource.k8s.io"]
|
|
resources: ["resourceclaims"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["resource.k8s.io"]
|
|
resources: ["resourceclaims/status"]
|
|
verbs: ["patch", "update"]
|
|
- apiGroups: ["resource.k8s.io"]
|
|
resources: ["resourceclaims/driver"]
|
|
verbs: ["associated-node:patch", "associated-node:update"]
|
|
resourceNames: ["dra-kubelet-plugin-driver-name"]
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["resource.k8s.io"]
|
|
resources: ["resourceslices"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: dra-kubelet-plugin-role-binding
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: dra-kubelet-plugin-service-account
|
|
namespace: dra-kubelet-plugin-namespace
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: dra-kubelet-plugin-role
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
# This ValidatingAdmissionPolicy is specific to the DRA driver's kubelet plugin
|
|
# because it checks the ServiceAccount defined for it above. An admin could
|
|
# also define a single policy for all drivers.
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicy
|
|
metadata:
|
|
name: resourceslices-policy-dra-kubelet-plugin
|
|
spec:
|
|
failurePolicy: Fail
|
|
matchConstraints:
|
|
resourceRules:
|
|
- apiGroups: ["resource.k8s.io"]
|
|
apiVersions: ["v1alpha3", "v1beta1", "v1beta2", "v1"]
|
|
operations: ["CREATE", "UPDATE", "DELETE"]
|
|
resources: ["resourceslices"]
|
|
matchConditions:
|
|
- name: isRestrictedUser
|
|
expression: >-
|
|
request.userInfo.username == "system:serviceaccount:dra-kubelet-plugin-namespace:dra-kubelet-plugin-service-account"
|
|
variables:
|
|
- name: userNodeName
|
|
expression: >-
|
|
request.userInfo.extra[?'authentication.kubernetes.io/node-name'][0].orValue('')
|
|
- name: objectNodeName
|
|
expression: >-
|
|
(request.operation == "DELETE" ? oldObject : object).spec.?nodeName.orValue("")
|
|
validations:
|
|
- expression: variables.userNodeName != ""
|
|
message: >-
|
|
no node association found for user, this user must run in a pod on a node and ServiceAccountTokenPodNodeInfo must be enabled
|
|
- expression: variables.userNodeName == variables.objectNodeName
|
|
messageExpression: >-
|
|
"this user running on node '"+variables.userNodeName+"' may not modify " +
|
|
(variables.objectNodeName == "" ?"cluster resourceslices" : "resourceslices on node '"+variables.objectNodeName+"'")
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicyBinding
|
|
metadata:
|
|
name: resourceslices-policy-dra-kubelet-plugin
|
|
spec:
|
|
policyName: resourceslices-policy-dra-kubelet-plugin
|
|
validationActions: [Deny]
|
|
# All ResourceSlices are matched.
|