Skip to content
This repository was archived by the owner on May 28, 2021. It is now read-only.

Commit 23e2cda

Browse files
prydieowainlewis
prydie
authored and
owainlewis
committed
Independent mysql-agent ClusterRole and RBAC (#121)
Separates the mysql-operator and mysql-agent ClusterRoles and scopes the RBAC to the minimal permissions required by each.
1 parent 934305f commit 23e2cda

File tree

14 files changed

+283
-244
lines changed

14 files changed

+283
-244
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ The MySQL Operator provides the following core features:
2828

2929
## Requirements
3030

31-
* Kubernetes 1.7.0 +
31+
* Kubernetes 1.8.0 +
3232

3333
## Contributing
3434

‎cmd/mysql-operator/app/mysql_operator.go

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -73,11 +73,6 @@ func Run(s *options.MySQLOperatorServer) error {
7373
kubeClient := kubernetes.NewForConfigOrDie(kubeconfig)
7474
mysqlopClient := mysqlop.NewForConfigOrDie(kubeconfig)
7575

76-
serverVersion, err := kubeClient.Discovery().ServerVersion()
77-
if err != nil {
78-
glog.Fatalf("Failed to discover Kubernetes API server version: %v", err)
79-
}
80-
8176
// Shared informers (non namespace specific).
8277
operatorInformerFactory := informers.NewFilteredSharedInformerFactory(mysqlopClient, resyncPeriod(s)(), s.Namespace, nil)
8378
kubeInformerFactory := kubeinformers.NewFilteredSharedInformerFactory(kubeClient, resyncPeriod(s)(), s.Namespace, nil)
@@ -88,12 +83,10 @@ func Run(s *options.MySQLOperatorServer) error {
8883
*s,
8984
mysqlopClient,
9085
kubeClient,
91-
serverVersion,
9286
operatorInformerFactory.Mysql().V1().MySQLClusters(),
9387
kubeInformerFactory.Apps().V1beta1().StatefulSets(),
9488
kubeInformerFactory.Core().V1().Pods(),
9589
kubeInformerFactory.Core().V1().Services(),
96-
kubeInformerFactory.Core().V1().ConfigMaps(),
9790
30*time.Second,
9891
s.Namespace,
9992
)

‎contrib/manifests/rbac.yaml

Lines changed: 105 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,45 +3,141 @@ apiVersion: v1
33
kind: ServiceAccount
44
metadata:
55
name: mysql-operator
6+
67
---
78
apiVersion: v1
89
kind: ServiceAccount
910
metadata:
1011
name: mysql-agent
12+
1113
---
1214
apiVersion: rbac.authorization.k8s.io/v1beta1
13-
kind: ClusterRole
15+
kind: Role
1416
metadata:
1517
name: mysql-operator
1618
rules:
1719
- apiGroups:
18-
- "*"
20+
- ""
1921
resources:
20-
- "*"
22+
- pods
2123
verbs:
22-
- "*"
24+
- get
25+
- list
26+
- patch
27+
- update
28+
- watch
29+
30+
- apiGroups:
31+
- ""
32+
resources:
33+
- secrets
34+
verbs:
35+
- create
36+
37+
- apiGroups:
38+
- ""
39+
resources:
40+
- services
41+
verbs:
42+
- create
43+
- get
44+
- list
45+
- watch
46+
47+
- apiGroups:
48+
- apps
49+
resources:
50+
- statefulsets
51+
verbs:
52+
- create
53+
- get
54+
- list
55+
- patch
56+
- update
57+
- watch
58+
59+
- apiGroups:
60+
- mysql.oracle.com
61+
resources:
62+
- mysqlbackups
63+
- mysqlbackupschedules
64+
- mysqlclusters
65+
- mysqlrestores
66+
verbs:
67+
- get
68+
- list
69+
- patch
70+
- update
71+
- watch
72+
73+
- apiGroups:
74+
- mysql.oracle.com
75+
resources:
76+
- mysqlbackups
77+
verbs:
78+
- create
79+
2380
---
2481
apiVersion: rbac.authorization.k8s.io/v1beta1
25-
kind: ClusterRoleBinding
82+
kind: ClusterRole
83+
metadata:
84+
name: mysql-agent
85+
rules:
86+
- apiGroups:
87+
- ""
88+
resources:
89+
- pods
90+
verbs:
91+
- get
92+
- list
93+
- patch
94+
- update
95+
- watch
96+
97+
- apiGroups:
98+
- ""
99+
resources:
100+
- secrets
101+
verbs:
102+
- get
103+
104+
- apiGroups:
105+
- mysql.oracle.com
106+
resources:
107+
- mysqlbackups
108+
- mysqlbackupschedules
109+
- mysqlclusters
110+
- mysqlrestores
111+
verbs:
112+
- get
113+
- list
114+
- patch
115+
- update
116+
- watch
117+
118+
---
119+
apiVersion: rbac.authorization.k8s.io/v1beta1
120+
kind: RoleBinding
26121
metadata:
27122
name: mysql-operator
28123
roleRef:
29124
apiGroup: rbac.authorization.k8s.io
30-
kind: ClusterRole
125+
kind: Role
31126
name: mysql-operator
32127
subjects:
33128
- kind: ServiceAccount
34129
name: mysql-operator
35130
namespace: <NAMESPACE>
131+
36132
---
37-
kind: ClusterRoleBinding
133+
kind: RoleBinding
38134
apiVersion: rbac.authorization.k8s.io/v1beta1
39135
metadata:
40136
name: mysql-agent
41137
roleRef:
42138
apiGroup: rbac.authorization.k8s.io
43-
kind: ClusterRole
44-
name: mysql-operator
139+
kind: Role
140+
name: mysql-agent
45141
subjects:
46142
- kind: ServiceAccount
47143
name: mysql-agent

‎docs/tutorial.md

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,10 @@ To install the chart in a cluster without RBAC with the release name `my-release
4747
$ helm install --name my-release mysql-operator
4848
```
4949

50-
If your cluster has RBAC enabled then you will need to run:
50+
If your cluster has RBAC disabled then you will need to run:
5151

5252
```console
53-
$ helm install --name my-release mysql-operator --set rbac.enabled=true
53+
$ helm install --name my-release mysql-operator --set rbac.enabled=false
5454
```
5555

5656
The above command deploys the MySQL Operator on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
@@ -73,11 +73,38 @@ The following tables lists the configurable parameters of the MySQL-operator cha
7373

7474
Parameter | Description | Default
7575
--------- | ----------- | -------
76-
`rbac.enabled` | If true, enables RBAC | `false`
76+
`rbac.enabled` | If true, enables RBAC | `true`
7777
`operator.namespace` | Controls the namespace in which the operator is deployed | `mysql-operator`
7878

7979
## Create a simple MySQL cluster
8080

81+
The first time you create a MySQL Cluster in a namespace you need to create the
82+
`mysql-agent` ServiceAccount and RoleBinding in that namespace:
83+
84+
```bash
85+
$ cat <<EOF | kubectl create -f -
86+
apiVersion: v1
87+
kind: ServiceAccount
88+
metadata:
89+
name: mysql-agent
90+
namespace: my-namespace
91+
---
92+
kind: RoleBinding
93+
apiVersion: rbac.authorization.k8s.io/v1beta1
94+
metadata:
95+
name: mysql-agent
96+
namespace: my-namespace
97+
roleRef:
98+
apiGroup: rbac.authorization.k8s.io
99+
kind: ClusterRole
100+
name: mysql-agent
101+
subjects:
102+
- kind: ServiceAccount
103+
name: mysql-agent
104+
namespace: my-namespace
105+
EOF
106+
```
107+
81108
Now let's create a new MySQL cluster. Create a cluster.yaml file with the following contents
82109

83110
```yaml

‎mysql-operator/templates/02-rbac.yaml

Lines changed: 106 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ kind: ServiceAccount
44
metadata:
55
name: mysql-operator
66
namespace: {{ if .Values.operator.global }}mysql-operator{{ else }}{{ .Values.operator.namespace}}{{ end }}
7+
78
---
89
apiVersion: v1
910
kind: ServiceAccount
1011
metadata:
1112
name: mysql-agent
1213
namespace: {{ if .Values.operator.global }}default{{ else }}{{ .Values.operator.namespace}}{{ end }}
14+
1315
---
1416
{{- if .Values.rbac.enabled }}
1517
apiVersion: rbac.authorization.k8s.io/v1beta1
@@ -19,14 +21,108 @@ metadata:
1921
namespace: {{ .Values.operator.namespace}}{{ end }}
2022
rules:
2123
- apiGroups:
22-
- "*"
24+
- ""
2325
resources:
24-
- "*"
26+
- pods
2527
verbs:
26-
- "*"
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
34+
- apiGroups:
35+
- ""
36+
resources:
37+
- secrets
38+
verbs:
39+
- create
40+
41+
- apiGroups:
42+
- ""
43+
resources:
44+
- services
45+
verbs:
46+
- create
47+
- get
48+
- list
49+
- watch
50+
51+
- apiGroups:
52+
- apps
53+
resources:
54+
- statefulsets
55+
verbs:
56+
- create
57+
- get
58+
- list
59+
- patch
60+
- update
61+
- watch
62+
63+
- apiGroups:
64+
- mysql.oracle.com
65+
resources:
66+
- mysqlbackups
67+
- mysqlbackupschedules
68+
- mysqlclusters
69+
- mysqlrestores
70+
verbs:
71+
- get
72+
- list
73+
- patch
74+
- update
75+
- watch
76+
77+
- apiGroups:
78+
- mysql.oracle.com
79+
resources:
80+
- mysqlbackups
81+
verbs:
82+
- create
83+
2784
---
2885
apiVersion: rbac.authorization.k8s.io/v1beta1
29-
kind: {{ if .Values.operator.global }}Cluster{{ end }}RoleBinding
86+
kind: {{ if .Values.operator.global }}Cluster{{ end }}Role
87+
metadata:
88+
name: mysql-agent{{ if .Values.operator.global }}{{ else}}
89+
namespace: {{ .Values.operator.namespace}}{{ end }}
90+
rules:
91+
- apiGroups:
92+
- ""
93+
resources:
94+
- pods
95+
verbs:
96+
- get
97+
- list
98+
- patch
99+
- update
100+
- watch
101+
102+
- apiGroups:
103+
- ""
104+
resources:
105+
- secrets
106+
verbs:
107+
- get
108+
109+
- apiGroups:
110+
- mysql.oracle.com
111+
resources:
112+
- mysqlbackups
113+
- mysqlbackupschedules
114+
- mysqlclusters
115+
- mysqlrestores
116+
verbs:
117+
- get
118+
- list
119+
- patch
120+
- update
121+
- watch
122+
123+
---
124+
apiVersion: rbac.authorization.k8s.io/v1beta1
125+
kind: {{ if .Values.operator.global }}Cluster{{ end }}RoleBinding
30126
metadata:
31127
name: mysql-operator
32128
namespace: {{ .Values.operator.namespace}}
@@ -38,18 +134,19 @@ subjects:
38134
- kind: ServiceAccount
39135
name: mysql-operator
40136
namespace: {{ .Values.operator.namespace }}
137+
41138
---
42-
kind: {{ if .Values.operator.global }}Cluster{{ end }}RoleBinding
43139
apiVersion: rbac.authorization.k8s.io/v1beta1
140+
kind: {{ if .Values.operator.global }}Cluster{{ end }}RoleBinding
44141
metadata:
45142
name: mysql-agent
46-
namespace: {{ if .Values.operator.global }}default{{ else }}{{ .Values.operator.namespace }}{{ end }}
143+
namespace: {{ .Values.operator.namespace}}
47144
roleRef:
48145
apiGroup: rbac.authorization.k8s.io
49-
kind: {{ if .Values.operator.global }}Cluster{{ end }}Role
50-
name: mysql-operator
146+
kind: {{ if .Values.operator.global }}Cluster{{ end }}Role
147+
name: mysql-agent
51148
subjects:
52149
- kind: ServiceAccount
53150
name: mysql-agent
54-
namespace: {{ if .Values.operator.global }}default{{ else }}{{ .Values.operator.namespace }}{{ end }}
151+
namespace: {{ .Values.operator.namespace }}
55152
{{- end }}

‎mysql-operator/values.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
rbac:
2-
enabled: false
2+
enabled: true
33
operator:
44
namespace: mysql-operator
55
global: true

0 commit comments

Comments
 (0)