scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-11-02 03:08:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #38816 from deads2k/rbac-23-switch-kubedns-sa

Browse Source 
Automatic merge from submit-queue

move kube-dns to a separate service account

Switches the kubedns addon to run as a separate service account so that we can subdivide RBAC permission for it.  The RBAC permissions will need a little more refinement which I'm expecting to find in https://github.com/kubernetes/kubernetes/pull/38626 .

@cjcullen @kubernetes/sig-auth since this is directly related to enabling RBAC with subdivided permissions
 @thockin @kubernetes/sig-network since this directly affects now kubedns is added.  


```release-note
`kube-dns` now runs using a separate `system:serviceaccount:kube-system:kube-dns` service account which is automatically bound to the correct RBAC permissions.
```
This commit is contained in:
Kubernetes Submit Queue
2017-02-23 12:06:13 -08:00
committed by GitHub
parent 17375fc59f 36b586d5d7
commit b799bbf0a8
12 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cluster/addons/dns/kubedns-controller.yaml.base
View File

@@ -157,3 +157,4 @@ spec:
memory: 20Mi
cpu: 10m
dnsPolicy: Default # Don't use cluster DNS.
serviceAccountName: kube-dns

1
cluster/addons/dns/kubedns-controller.yaml.in
View File

@@ -157,3 +157,4 @@ spec:
memory: 20Mi
cpu: 10m
dnsPolicy: Default # Don't use cluster DNS.
serviceAccountName: kube-dns

1
cluster/addons/dns/kubedns-controller.yaml.sed
View File

@@ -156,3 +156,4 @@ spec:
memory: 20Mi
cpu: 10m
dnsPolicy: Default # Don't use cluster DNS.
serviceAccountName: kube-dns

6
cluster/addons/dns/kubedns-sa.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: kube-dns
labels:
kubernetes.io/cluster-service: "true"

1
cluster/centos/deployAddons.sh
View File

@@ -33,6 +33,7 @@ function deploy_dns {
if [ ! "$KUBEDNS" ]; then
# use kubectl to create kube-dns deployment and service
${KUBECTL} --namespace=kube-system create -f kubedns-sa.yaml
${KUBECTL} --namespace=kube-system create -f kubedns-controller.yaml
${KUBECTL} --namespace=kube-system create -f kubedns-svc.yaml

1
cluster/libvirt-coreos/config-default.sh
View File

@@ -67,6 +67,7 @@ ENABLE_DNS_HORIZONTAL_AUTOSCALER="${KUBE_ENABLE_DNS_HORIZONTAL_AUTOSCALER:-false
#Generate dns files
sed -f "${KUBE_ROOT}/cluster/addons/dns/transforms2sed.sed" < "${KUBE_ROOT}/cluster/addons/dns/kubedns-controller.yaml.base" | sed -f "${KUBE_ROOT}/cluster/libvirt-coreos/forShellEval.sed" > "${KUBE_ROOT}/cluster/libvirt-coreos/kubedns-controller.yaml"
sed -f "${KUBE_ROOT}/cluster/addons/dns/transforms2sed.sed" < "${KUBE_ROOT}/cluster/addons/dns/kubedns-svc.yaml.base" | sed -f "${KUBE_ROOT}/cluster/libvirt-coreos/forShellEval.sed" > "${KUBE_ROOT}/cluster/libvirt-coreos/kubedns-svc.yaml"
cp "${KUBE_ROOT}/cluster/addons/dns/kubedns-sa.yaml" "${KUBE_ROOT}/cluster/libvirt-coreos/kubedns-sa.yaml"
#Generate registry files

1
cluster/libvirt-coreos/util.sh
View File

@@ -187,6 +187,7 @@ function initialize-pool {
render-template "$ROOT/namespace.yaml" > "$POOL_PATH/kubernetes/addons/namespace.yaml"
render-template "$ROOT/kubedns-svc.yaml" > "$POOL_PATH/kubernetes/addons/kubedns-svc.yaml"
render-template "$ROOT/kubedns-controller.yaml" > "$POOL_PATH/kubernetes/addons/kubedns-controller.yaml"
render-template "$ROOT/kubedns-sa.yaml" > "$POOL_PATH/kubernetes/addons/kubedns-sa.yaml"
fi
virsh pool-refresh $POOL

2
cluster/ubuntu/deployAddons.sh
View File

@@ -43,11 +43,13 @@ function deploy_dns {
echo "Deploying DNS on Kubernetes"
sed -e "s/\\\$DNS_DOMAIN/${DNS_DOMAIN}/g" "${KUBE_ROOT}/cluster/addons/dns/kubedns-controller.yaml.sed" > kubedns-controller.yaml
sed -e "s/\\\$DNS_SERVER_IP/${DNS_SERVER_IP}/g" "${KUBE_ROOT}/cluster/addons/dns/kubedns-svc.yaml.sed" > kubedns-svc.yaml
cp "${KUBE_ROOT}/cluster/addons/dns/kubedns-sa.yaml" kubedns-sa.yaml
KUBEDNS=`eval "${KUBECTL} get services --namespace=kube-system | grep kube-dns | cat"`
if [ ! "$KUBEDNS" ]; then
# use kubectl to create kubedns controller and service
${KUBECTL} --namespace=kube-system create -f kubedns-sa.yaml
${KUBECTL} --namespace=kube-system create -f kubedns-controller.yaml
${KUBECTL} --namespace=kube-system create -f kubedns-svc.yaml