Merge "[k8s] Update Cluster Autoscaler ClusterRole"
This commit is contained in:
commit
0c2e181131
|
@ -20,56 +20,68 @@ if [[ "${auto_scaling_enabled}" = "true" || ("${auto_healing_enabled}" = "true"
|
||||||
mkdir -p $(dirname ${AUTOSCALER_DEPLOY})
|
mkdir -p $(dirname ${AUTOSCALER_DEPLOY})
|
||||||
cat << EOF > ${AUTOSCALER_DEPLOY}
|
cat << EOF > ${AUTOSCALER_DEPLOY}
|
||||||
---
|
---
|
||||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
metadata:
|
metadata:
|
||||||
name: cluster-autoscaler-role
|
name: cluster-autoscaler-role
|
||||||
rules:
|
rules:
|
||||||
- apiGroups: [""]
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
resources: ["events", "endpoints"]
|
resources: ["leases"]
|
||||||
verbs: ["create", "patch"]
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["pods/eviction"]
|
|
||||||
verbs: ["create"]
|
verbs: ["create"]
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources: ["leases"]
|
||||||
|
resourceNames: ["cluster-autoscaler"]
|
||||||
|
verbs: ["get", "update", "patch", "delete"]
|
||||||
|
# TODO: remove in 1.18; CA uses lease objects for leader election since 1.17
|
||||||
- apiGroups: [""]
|
- apiGroups: [""]
|
||||||
resources: ["pods/status"]
|
resources: ["endpoints"]
|
||||||
verbs: ["update"]
|
verbs: ["create"]
|
||||||
- apiGroups: [""]
|
- apiGroups: [""]
|
||||||
resources: ["endpoints"]
|
resources: ["endpoints"]
|
||||||
resourceNames: ["cluster-autoscaler"]
|
resourceNames: ["cluster-autoscaler"]
|
||||||
verbs: ["get", "update"]
|
verbs: ["get", "update", "patch", "delete"]
|
||||||
|
# accessing & modifying cluster state (nodes & pods)
|
||||||
- apiGroups: [""]
|
- apiGroups: [""]
|
||||||
resources: ["nodes"]
|
resources: ["nodes"]
|
||||||
verbs: ["watch", "list", "get", "update"]
|
verbs: ["get", "list", "watch", "update", "patch"]
|
||||||
- apiGroups: [""]
|
- apiGroups: [""]
|
||||||
resources:
|
resources: ["pods"]
|
||||||
- "pods"
|
verbs: ["get", "list", "watch"]
|
||||||
- "services"
|
- apiGroups: [""]
|
||||||
- "replicationcontrollers"
|
resources: ["pods/eviction"]
|
||||||
- "persistentvolumeclaims"
|
verbs: ["create"]
|
||||||
- "persistentvolumes"
|
# read-only access to cluster state
|
||||||
verbs: ["watch", "list", "get"]
|
- apiGroups: [""]
|
||||||
|
resources: ["services", "replicationcontrollers", "persistentvolumes", "persistentvolumeclaims"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["apps"]
|
||||||
|
resources: ["daemonsets", "replicasets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["apps"]
|
||||||
|
resources: ["statefulsets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
- apiGroups: ["batch"]
|
- apiGroups: ["batch"]
|
||||||
resources: ["jobs"]
|
resources: ["jobs"]
|
||||||
verbs: ["watch", "list", "get"]
|
verbs: ["get", "list", "watch"]
|
||||||
- apiGroups: ["policy"]
|
- apiGroups: ["policy"]
|
||||||
resources: ["poddisruptionbudgets"]
|
resources: ["poddisruptionbudgets"]
|
||||||
verbs: ["watch", "list"]
|
verbs: ["get", "list", "watch"]
|
||||||
- apiGroups: ["apps"]
|
|
||||||
resources: ["daemonsets", "replicasets", "statefulsets"]
|
|
||||||
verbs: ["watch", "list", "get"]
|
|
||||||
- apiGroups: ["storage.k8s.io"]
|
- apiGroups: ["storage.k8s.io"]
|
||||||
resources: ["storageclasses"]
|
resources: ["storageclasses", "csinodes"]
|
||||||
verbs: ["watch", "list", "get"]
|
verbs: ["get", "list", "watch"]
|
||||||
|
# misc access
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "update", "patch"]
|
||||||
- apiGroups: [""]
|
- apiGroups: [""]
|
||||||
resources: ["configmaps"]
|
resources: ["configmaps"]
|
||||||
verbs: ["create"]
|
verbs: ["create"]
|
||||||
- apiGroups: [""]
|
- apiGroups: [""]
|
||||||
resources: ["configmaps"]
|
resources: ["configmaps"]
|
||||||
resourceNames: ["cluster-autoscaler-status"]
|
resourceNames: ["cluster-autoscaler-status"]
|
||||||
verbs: ["delete", "get", "update"]
|
verbs: ["get", "update", "patch", "delete"]
|
||||||
---
|
---
|
||||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
kind: ClusterRoleBinding
|
kind: ClusterRoleBinding
|
||||||
metadata:
|
metadata:
|
||||||
name: cluster-autoscaler-rolebinding
|
name: cluster-autoscaler-rolebinding
|
||||||
|
|
Loading…
Reference in New Issue