Skip to content

Commit cd98e93

Browse files
dzlier-gcpmarkmandel
dzlier-gcp
authored and
markmandel
committed
Enable RBAC, and create service accounts/roles/rolebindings for sidecar and controller as appropriate.
1 parent e56472a commit cd98e93

6 files changed

Lines changed: 220 additions & 4 deletions

File tree

‎build/Makefile‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,7 @@ gcloud-auth-cluster: ensure-build-image
231231
docker run --rm $(common_mounts) $(build_tag) gcloud config set compute/zone \
232232
`grep zone: $(build_path)/gke-test-cluster/deployment.yml | sed 's/zone: //'`
233233
docker run --rm $(common_mounts) $(build_tag) gcloud container clusters get-credentials $(CLUSTER_NAME)
234+
-docker run --rm $(common_mounts) $(build_tag) bash -c 'kubectl create clusterrolebinding cluster-admin-binding --clusterrole cluster-admin --user $$(gcloud config get-value account)'
234235

235236
# authenticate our docker configuration so that you can do a docker push directly
236237
# to the gcr.io repository
@@ -259,7 +260,17 @@ clean-gcloud-config:
259260
# Use MINIKUBE_DRIVER variable to change the VM driver
260261
# (defaults virtualbox for Linux and macOS, hyperv for windows) if you so desire.
261262
minikube-test-cluster: minikube-agones-profile
262-
$(MINIKUBE) start --kubernetes-version v1.8.0 --vm-driver $(MINIKUBE_DRIVER)
263+
$(MINIKUBE) start --kubernetes-version v1.8.0 --vm-driver $(MINIKUBE_DRIVER) \
264+
--extra-config=apiserver.Authorization.Mode=RBAC
265+
# wait until the master is up
266+
until docker run --rm $(common_mounts) --network=host -v $(minikube_cert_mount) $(DOCKER_RUN_ARGS) $(build_tag) kubectl cluster-info; \
267+
do \
268+
echo "Waiting for cluster to start..."; \
269+
sleep 1; \
270+
done
271+
# this is needed for kubernetes component to work correctly while RBAC is enabled
272+
-docker run --rm $(common_mounts) --network=host -v $(minikube_cert_mount) $(DOCKER_RUN_ARGS) $(build_tag) \
273+
kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:default
263274
$(MAKE) minikube-post-start
264275

265276
# switch to the agones cluster
@@ -285,4 +296,4 @@ minikube-install: minikube-agones-profile
285296
# Convenience target for transferring images into minikube.
286297
# Use TAG to specify the image to transfer into minikube
287298
minikube-transfer-image:
288-
docker save $(TAG) | ($(MINIKUBE_DOCKER_ENV) && docker load)
299+
docker save $(TAG) | ($(MINIKUBE_DOCKER_ENV) && docker load)

‎build/gke-test-cluster/cluster.yml.jinja‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ resources:
2121
cluster:
2222
name: test-cluster
2323
description: Test cluster for Agones
24+
initialClusterVersion: 1.8.7-gke.1
2425
nodePools:
2526
- name: "default"
2627
initialNodeCount: 3
@@ -35,6 +36,8 @@ resources:
3536
masterAuth:
3637
username: admin
3738
password: supersecretpassword
39+
legacyAbac:
40+
enabled: false
3841
- name: game-server-firewall
3942
type: compute.beta.firewall
4043
properties:

‎build/install.yaml‎

Lines changed: 95 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
# Install with development settings - suggest using `make install` to run
16-
1715
apiVersion: v1
1816
kind: Namespace
1917
metadata:
@@ -48,6 +46,7 @@ spec:
4846
labels:
4947
stable.agones.dev/role: controller
5048
spec:
49+
serviceAccountName: agones-controller
5150
containers:
5251
- name: agones-controller
5352
image: ${REGISTRY}/agones-controller:${VERSION}
@@ -67,3 +66,97 @@ spec:
6766
port: 8080
6867
initialDelaySeconds: 3
6968
periodSeconds: 3
69+
---
70+
# Service account, secret, role and rolebinding for sidecar (agones-sdk) pod
71+
apiVersion: v1
72+
kind: ServiceAccount
73+
metadata:
74+
name: agones-sdk
75+
secrets:
76+
- name: agones-sdk-secret
77+
---
78+
apiVersion: v1
79+
kind: Secret
80+
metadata:
81+
name: agones-sdk-secret
82+
annotations:
83+
kubernetes.io/service-account.name: agones-sdk
84+
type: kubernetes.io/service-account-token
85+
---
86+
apiVersion: rbac.authorization.k8s.io/v1
87+
kind: ClusterRole
88+
metadata:
89+
name: agones-sdk
90+
namespace: agones-system
91+
rules:
92+
- apiGroups: ["stable.agones.dev"]
93+
resources: ["gameservers"]
94+
verbs: ["get", "update"]
95+
---
96+
apiVersion: rbac.authorization.k8s.io/v1
97+
kind: ClusterRoleBinding
98+
metadata:
99+
name: agones-sdk-access
100+
namespace: agones-system
101+
subjects:
102+
- kind: User
103+
name: system:serviceaccount:default:agones-sdk
104+
apiGroup: rbac.authorization.k8s.io
105+
roleRef:
106+
apiGroup: rbac.authorization.k8s.io
107+
kind: ClusterRole
108+
name: agones-sdk
109+
---
110+
# Service account, secret, role and rolebinding for agones-controller
111+
apiVersion: v1
112+
kind: ServiceAccount
113+
metadata:
114+
name: agones-controller
115+
namespace: agones-system
116+
secrets:
117+
- name: agones-controller-secret
118+
---
119+
apiVersion: v1
120+
kind: Secret
121+
metadata:
122+
name: agones-controller-secret
123+
namespace: agones-system
124+
annotations:
125+
kubernetes.io/service-account.name: agones-controller
126+
type: kubernetes.io/service-account-token
127+
---
128+
apiVersion: rbac.authorization.k8s.io/v1
129+
kind: ClusterRole
130+
metadata:
131+
name: agones-controller
132+
namespace: agones-system
133+
rules:
134+
- apiGroups: [""]
135+
resources: ["events"]
136+
verbs: ["create"]
137+
- apiGroups: [""]
138+
resources: ["pods"]
139+
verbs: ["create", "delete", "list", "watch"]
140+
- apiGroups: [""]
141+
resources: ["nodes"]
142+
verbs: ["list", "watch"]
143+
- apiGroups: ["apiextensions.k8s.io"]
144+
resources: ["customresourcedefinitions"]
145+
verbs: ["get"]
146+
- apiGroups: ["stable.agones.dev"]
147+
resources: ["gameservers"]
148+
verbs: ["delete", "get", "list", "update", "watch"]
149+
---
150+
apiVersion: rbac.authorization.k8s.io/v1
151+
kind: ClusterRoleBinding
152+
metadata:
153+
name: agones-controller-access
154+
namespace: agones-system
155+
subjects:
156+
- kind: User
157+
name: system:serviceaccount:agones-system:agones-controller
158+
apiGroup: rbac.authorization.k8s.io
159+
roleRef:
160+
apiGroup: rbac.authorization.k8s.io
161+
kind: ClusterRole
162+
name: agones-controller

‎install.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15+
apiVersion: v1
16+
kind: Namespace
17+
metadata:
18+
name: agones-system
19+
---
1520
apiVersion: apiextensions.k8s.io/v1beta1
1621
kind: CustomResourceDefinition
1722
metadata:
@@ -31,6 +36,7 @@ apiVersion: extensions/v1beta1
3136
kind: Deployment
3237
metadata:
3338
name: agones-controller
39+
namespace: agones-system
3440
spec:
3541
replicas: 1
3642
strategy:
@@ -40,6 +46,7 @@ spec:
4046
labels:
4147
stable.agones.dev/role: controller
4248
spec:
49+
serviceAccountName: agones-controller
4350
containers:
4451
- name: agones-controller
4552
image: gcr.io/agones-images/agones-controller:0.1
@@ -58,3 +65,97 @@ spec:
5865
port: 8080
5966
initialDelaySeconds: 3
6067
periodSeconds: 3
68+
---
69+
# Service account, secret, role and rolebinding for sidecar (agones-sdk) pod
70+
apiVersion: v1
71+
kind: ServiceAccount
72+
metadata:
73+
name: agones-sdk
74+
secrets:
75+
- name: agones-sdk-secret
76+
---
77+
apiVersion: v1
78+
kind: Secret
79+
metadata:
80+
name: agones-sdk-secret
81+
annotations:
82+
kubernetes.io/service-account.name: agones-sdk
83+
type: kubernetes.io/service-account-token
84+
---
85+
apiVersion: rbac.authorization.k8s.io/v1
86+
kind: ClusterRole
87+
metadata:
88+
name: agones-sdk
89+
namespace: agones-system
90+
rules:
91+
- apiGroups: ["stable.agones.dev"]
92+
resources: ["gameservers"]
93+
verbs: ["get", "update"]
94+
---
95+
apiVersion: rbac.authorization.k8s.io/v1
96+
kind: ClusterRoleBinding
97+
metadata:
98+
name: agones-sdk-access
99+
namespace: agones-system
100+
subjects:
101+
- kind: User
102+
name: system:serviceaccount:default:agones-sdk
103+
apiGroup: rbac.authorization.k8s.io
104+
roleRef:
105+
apiGroup: rbac.authorization.k8s.io
106+
kind: ClusterRole
107+
name: agones-sdk
108+
---
109+
# Service account, secret, role and rolebinding for agones-controller
110+
apiVersion: v1
111+
kind: ServiceAccount
112+
metadata:
113+
name: agones-controller
114+
namespace: agones-system
115+
secrets:
116+
- name: agones-controller-secret
117+
---
118+
apiVersion: v1
119+
kind: Secret
120+
metadata:
121+
name: agones-controller-secret
122+
namespace: agones-system
123+
annotations:
124+
kubernetes.io/service-account.name: agones-controller
125+
type: kubernetes.io/service-account-token
126+
---
127+
apiVersion: rbac.authorization.k8s.io/v1
128+
kind: ClusterRole
129+
metadata:
130+
name: agones-controller
131+
namespace: agones-system
132+
rules:
133+
- apiGroups: [""]
134+
resources: ["events"]
135+
verbs: ["create"]
136+
- apiGroups: [""]
137+
resources: ["pods"]
138+
verbs: ["create", "delete", "list", "watch"]
139+
- apiGroups: [""]
140+
resources: ["nodes"]
141+
verbs: ["list", "watch"]
142+
- apiGroups: ["apiextensions.k8s.io"]
143+
resources: ["customresourcedefinitions"]
144+
verbs: ["get"]
145+
- apiGroups: ["stable.agones.dev"]
146+
resources: ["gameservers"]
147+
verbs: ["delete", "get", "list", "update", "watch"]
148+
---
149+
apiVersion: rbac.authorization.k8s.io/v1
150+
kind: ClusterRoleBinding
151+
metadata:
152+
name: agones-controller-access
153+
namespace: agones-system
154+
subjects:
155+
- kind: User
156+
name: system:serviceaccount:agones-system:agones-controller
157+
apiGroup: rbac.authorization.k8s.io
158+
roleRef:
159+
apiGroup: rbac.authorization.k8s.io
160+
kind: ClusterRole
161+
name: agones-controller

‎pkg/apis/stable/v1alpha1/types.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,8 @@ const (
6161
// GameServerContainerAnnotation is the annotation that stores
6262
// which container is the container that runs the dedicated game server
6363
GameServerContainerAnnotation = stable.GroupName + "/container"
64+
// SidecarServiceAccountName is the default service account for managing access to get/update GameServers
65+
SidecarServiceAccountName = "agones-sdk"
6466
)
6567

6668
var (
@@ -204,6 +206,9 @@ func (gs *GameServer) Pod(sidecars ...corev1.Container) (*corev1.Pod, error) {
204206
pod.ObjectMeta.Namespace = gs.ObjectMeta.Namespace
205207
// Make sure these are blank, just in case
206208
pod.ResourceVersion = ""
209+
if pod.Spec.ServiceAccountName == "" {
210+
pod.Spec.ServiceAccountName = SidecarServiceAccountName
211+
}
207212
pod.UID = ""
208213
if pod.ObjectMeta.Labels == nil {
209214
pod.ObjectMeta.Labels = make(map[string]string, 2)

‎pkg/apis/stable/v1alpha1/types_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ func TestGameServerPod(t *testing.T) {
169169
assert.Equal(t, "gameserver", pod.ObjectMeta.Labels[stable.GroupName+"/role"])
170170
assert.Equal(t, fixture.ObjectMeta.Name, pod.ObjectMeta.Labels[GameServerPodLabel])
171171
assert.Equal(t, fixture.Spec.Container, pod.ObjectMeta.Annotations[GameServerContainerAnnotation])
172+
assert.Equal(t, "agones-sdk", pod.Spec.ServiceAccountName)
172173
assert.True(t, metav1.IsControlledBy(pod, fixture))
173174
assert.Equal(t, fixture.Spec.HostPort, pod.Spec.Containers[0].Ports[0].HostPort)
174175
assert.Equal(t, fixture.Spec.ContainerPort, pod.Spec.Containers[0].Ports[0].ContainerPort)
@@ -177,10 +178,12 @@ func TestGameServerPod(t *testing.T) {
177178
assert.True(t, metav1.IsControlledBy(pod, fixture))
178179

179180
sidecar := corev1.Container{Name: "sidecar", Image: "container/sidecar"}
181+
fixture.Spec.Template.Spec.ServiceAccountName = "other-agones-sdk"
180182
pod, err = fixture.Pod(sidecar)
181183
assert.Nil(t, err, "Pod should not return an error")
182184
assert.Equal(t, fixture.ObjectMeta.Name+"-", pod.ObjectMeta.GenerateName)
183185
assert.Len(t, pod.Spec.Containers, 2, "Should have two containers")
186+
assert.Equal(t, "other-agones-sdk", pod.Spec.ServiceAccountName)
184187
assert.Equal(t, "container", pod.Spec.Containers[0].Name)
185188
assert.Equal(t, "sidecar", pod.Spec.Containers[1].Name)
186189
assert.True(t, metav1.IsControlledBy(pod, fixture))

0 commit comments

Comments
 (0)