Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

aggregate admin from edit and view to ensure coverage #66684

Merged
merged 1 commit into from
Aug 1, 2018
Merged

aggregate admin from edit and view to ensure coverage #66684

merged 1 commit into from
Aug 1, 2018
+45 −315

Conversation

deads2k
Copy link
Contributor

@deads2k deads2k commented Jul 26, 2018 •
edited
Loading

ClusterRole aggregate has worked quite well. This updates the edit role to be aggregated from a separate edit and view and updates the admin role to aggregated from admin, edit, and view. This ensures coverage (we previously had unit tests, but that didn't work as people aggregated more powers in) and it makes each role smaller since it only has a diff to consider.

@kubernetes/sig-auth-pr-reviews

admin RBAC role now aggregates edit and view.  edit RBAC role now aggregates view.

@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jul 26, 2018
@deads2k deads2k force-pushed the rbac-01-aggregate branch from df5615c to 3c1495d Compare July 26, 2018 19:14
@k8s-ci-robot k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 26, 2018
@liggitt liggitt requested review from liggitt and tallclair and removed request for ericchiang and erictune July 26, 2018 19:34
@liggitt
Copy link
Member

liggitt commented Jul 26, 2018

looks reasonable to me. can you verify reconciliation on this works properly in both directions? (a 1.12 apiserver would add the new selectors on startup, and a 1.11 server would not remove them on startup)

@liggitt
Copy link
Member

liggitt commented Jul 26, 2018

needs a release note as well

@deads2k
Copy link
Contributor Author

deads2k commented Jul 27, 2018

looks reasonable to me. can you verify reconciliation on this works properly in both directions? (a 1.12 apiserver would add the new selectors on startup, and a 1.11 server would not remove them on startup)

Labels don't collide with any reasonably existing thing and the reconcile attaches them: https://github.com/kubernetes/kubernetes/blob/master/pkg/registry/rbac/reconciliation/reconcile_role.go#L186-L194

@k8s-ci-robot k8s-ci-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Jul 27, 2018
@deads2k
Copy link
Contributor Author

deads2k commented Jul 27, 2018

needs a release note as well

added

@enj
Copy link
Member

enj commented Jul 27, 2018

Fancy.

@deads2k
Copy link
Contributor Author

deads2k commented Jul 30, 2018

@mikedanese ptal.

@enj
Copy link
Member

enj commented Aug 1, 2018

/lgtm

I see no test failures so if something is missing RBAC it needs to add a test that actually uses it 😄

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 1, 2018
@k8s-github-robot
Copy link

/test all

Tests are more than 96 hours old. Re-running tests.

@mikedanese mikedanese self-assigned this Aug 1, 2018
@mikedanese
Copy link
Member

This is much nicer.

/lgtm

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, enj, mikedanese

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 65730, 66615, 66684, 66519, 66510). If you want to cherry-pick this change to another branch, please follow the instructions here.

@k8s-github-robot k8s-github-robot merged commit 695d4fb into kubernetes:master Aug 1, 2018
@neolit123
Copy link
Member

/sig auth

@k8s-ci-robot k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Aug 24, 2018
@dims dims mentioned this pull request Sep 28, 2018
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt Awaiting requested review from liggitt

@tallclair tallclair Awaiting requested review from tallclair

Assignees

@mikedanese mikedanese

@enj enj

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@deads2k @liggitt @enj @k8s-github-robot @mikedanese @k8s-ci-robot @neolit123