Expected Behavior
I should be able to create a ServiceAccount and give it RBAC permissions to resolve all known Addressables. If a new Addressable Kind is created, my ServiceAccount should get permission to resolve it as well, without needing any work specific to this ServiceAccount.
Actual Behavior
Today all the ServiceAccounts seem to get their own custom ClusterRoles that include all known Addressables at the time. Creating a new Addressable causes all of those ClusterRoles to be updated (see knative/eventing-contrib#252).
Proposal
We create a single aggregated ClusterRole. Then whenever a new Addressable is created, it is the responsibility of that CRD's author to create a ClusterRole that will aggregate the new permissions into the single aggregated ClusterRole.
E.g.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: addressable-resolver
aggregationRule:
clusterRoleSelectors:
- matchLabels:
eventing.knative.dev/addressable: "true"
rules: [] # Rules are automatically filled in by the controller manager.Then to make Broker resolve correctly, the creator of the Broker CRD also creates the following:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: broker-addressable-resolver
labels:
eventing.knative.dev/addressable: "true"
# Do not use this role directly. These rules will be added to the "addressable-resolver" role.
rules:
- apiGroups:
- eventing.knative.dev/v1alpha1
resources:
- brokers
- brokers/status
verbs:
- get
- list
- watchThen, as a user creating a ServiceAccount that needs to resolve Addressables, I give the following ClusterRoleBinding/RoleBinding:
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: foo-addressable-resolver
subjects:
- kind: serviceAccount
name: foo
roleRef:
kind: ClusterRole
name: addressable-resolver
apiGroup: rbac.authorization.k8s.io
So when someone adds another Addressable CRD (e.g. Channel), they also add the ClusterRole that will get aggregated into addressable-resolver and the ServiceAccount foo automatically gets that permission without any further work.
Expected Behavior
I should be able to create a
ServiceAccountand give it RBAC permissions to resolve all knownAddressables. If a newAddressableKind is created, myServiceAccountshould get permission to resolve it as well, without needing any work specific to thisServiceAccount.Actual Behavior
Today all the
ServiceAccounts seem to get their own customClusterRoles that include all known Addressables at the time. Creating a new Addressable causes all of thoseClusterRoles to be updated (see knative/eventing-contrib#252).Proposal
We create a single aggregated
ClusterRole. Then whenever a new Addressable is created, it is the responsibility of that CRD's author to create aClusterRolethat will aggregate the new permissions into the single aggregatedClusterRole.E.g.
Then to make
Brokerresolve correctly, the creator of theBrokerCRD also creates the following:Then, as a user creating a
ServiceAccountthat needs to resolve Addressables, I give the followingClusterRoleBinding/RoleBinding:So when someone adds another Addressable CRD (e.g.
Channel), they also add theClusterRolethat will get aggregated intoaddressable-resolverand theServiceAccountfoo automatically gets that permission without any further work.