feat(permissions): Adding node as a resource in RBAC (#193)

Signed-off-by: shubhamchaudhary <shubham.chaudhary@mayadata.io>
2020-03-26 17:22:50 +05:30
parent f1cf739b3b
commit 1f7ad0f1e1
35 changed files with 152 additions and 59 deletions
--- a/charts/generic/container-kill/experiment.yaml
+++ b/charts/generic/container-kill/experiment.yaml
@@ -31,6 +31,13 @@ spec:
          - "update"
          - "patch"
          - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
    image: "litmuschaos/ansible-runner:latest"
    args:
    - -c
--- a/charts/generic/container-kill/rbac.yaml
+++ b/charts/generic/container-kill/rbac.yaml
@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch","apps"]
  resources: ["pods","jobs","daemonsets","pods/exec","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
  verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
--- a/charts/generic/container-kill/rbac_nginx_getstarted.yaml
+++ b/charts/generic/container-kill/rbac_nginx_getstarted.yaml
@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch","apps"]
  resources: ["pods","jobs","daemonsets","pods/exec","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
  verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
--- a/charts/generic/disk-fill/experiment.yaml
+++ b/charts/generic/disk-fill/experiment.yaml
@@ -32,6 +32,13 @@ spec:
          - "patch"
          - "update"
          - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
    image: "litmuschaos/ansible-runner:latest"
    args:
    - -c
--- a/charts/generic/disk-fill/rbac.yaml
+++ b/charts/generic/disk-fill/rbac.yaml
@@ -17,6 +17,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch"]
  resources: ["pods","jobs","pods/exec","events","pods/log","daemonsets","chaosengines","chaosexperiments","chaosresults"]
  verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
--- a/charts/generic/node-cpu-hog/experiment.yaml
+++ b/charts/generic/node-cpu-hog/experiment.yaml
@@ -35,7 +35,7 @@ spec:
          - ""
        resources: 
          - "nodes"
-        verbs :
+        verbs:
          - "get"
          - "list"
    image: "litmuschaos/ansible-runner:latest"
--- a/charts/generic/node-cpu-hog/rbac.yaml
+++ b/charts/generic/node-cpu-hog/rbac.yaml
@@ -19,7 +19,7 @@ rules:
  verbs: ["create","list","get","patch","update","delete"]
 - apiGroups: [""]
  resources: ["nodes"]
-  verbs : ["get","list"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
--- a/charts/generic/node-drain/experiment.yaml
+++ b/charts/generic/node-drain/experiment.yaml
@@ -37,7 +37,7 @@ spec:
          - ""
        resources: 
          - "nodes"
-        verbs :
+        verbs:
          - "get"
          - "list"
          - "patch"
--- a/charts/generic/node-memory-hog/experiment.yaml
+++ b/charts/generic/node-memory-hog/experiment.yaml
@@ -34,7 +34,7 @@ spec:
          - ""
        resources: 
          - "nodes"
-        verbs :
+        verbs:
          - "get"
          - "list"
    image: "litmuschaos/ansible-runner:latest"
--- a/charts/generic/node-memory-hog/rbac.yaml
+++ b/charts/generic/node-memory-hog/rbac.yaml
@@ -19,7 +19,7 @@ rules:
  verbs: ["create","list","get","patch","update","delete"]
 - apiGroups: [""]
  resources: ["nodes"]
-  verbs : ["get","list"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
--- a/charts/generic/pod-cpu-hog/experiment.yaml
+++ b/charts/generic/pod-cpu-hog/experiment.yaml
@@ -29,6 +29,13 @@ spec:
          - "patch"
          - "update"
          - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
    image: "litmuschaos/ansible-runner:latest"
    args:
    - -c
--- a/charts/generic/pod-cpu-hog/rbac.yaml
+++ b/charts/generic/pod-cpu-hog/rbac.yaml
@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
  resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
  verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
--- a/charts/generic/pod-delete/experiment.yaml
+++ b/charts/generic/pod-delete/experiment.yaml
@@ -36,7 +36,7 @@ spec:
          - ""
        resources: 
          - "nodes"
-        verbs :
+        verbs:
          - "get"
          - "list"
    image: "litmuschaos/ansible-runner:latest"
--- a/charts/generic/pod-delete/rbac.yaml
+++ b/charts/generic/pod-delete/rbac.yaml
@@ -20,7 +20,7 @@ rules:
  verbs: ["create","list","get","patch","update","delete"]
 - apiGroups: [""]
  resources: ["nodes"]
-  verbs : ["get","list"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
--- a/charts/generic/pod-network-corruption/experiment.yaml
+++ b/charts/generic/pod-network-corruption/experiment.yaml
@@ -29,6 +29,13 @@ spec:
          - "patch"
          - "update"
          - "get"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
    image: "litmuschaos/ansible-runner:latest"
    args:
    - -c
--- a/charts/generic/pod-network-corruption/rbac.yaml
+++ b/charts/generic/pod-network-corruption/rbac.yaml
@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
  resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
  verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
--- a/charts/generic/pod-network-latency/experiment.yaml
+++ b/charts/generic/pod-network-latency/experiment.yaml
@@ -29,6 +29,13 @@ spec:
          - "patch"
          - "update"
          - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
    image: "litmuschaos/ansible-runner:latest"
    args:
    - -c
--- a/charts/generic/pod-network-latency/rbac.yaml
+++ b/charts/generic/pod-network-latency/rbac.yaml
@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
  resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
  verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
--- a/charts/generic/pod-network-loss/experiment.yaml
+++ b/charts/generic/pod-network-loss/experiment.yaml
@@ -11,24 +11,31 @@ spec:
    scope: Namespaced
    permissions:
    - apiGroups:
-      - ""
-      - "batch"
-      - "litmuschaos.io"
+        - ""
+        - "batch"
+        - "litmuschaos.io"
      resources:
-      - "jobs"
-      - "pods"
-      - "pods/log"
-      - "events"
-      - "chaosengines"
-      - "chaosexperiments"
-      - "chaosresults"
+        - "jobs"
+        - "pods"
+        - "pods/log"
+        - "events"
+        - "chaosengines"
+        - "chaosexperiments"
+        - "chaosresults"
      verbs:
-      - "get"
-      - "list"
-      - "patch"
-      - "create"
-      - "update"
-      - "delete"
+        - "get"
+        - "list"
+        - "patch"
+        - "create"
+        - "update"
+        - "delete"
+    - apiGroups:
+        - ""
+      resources: 
+        - "nodes"
+      verbs:
+        - "get"
+        - "list"
    image: "litmuschaos/ansible-runner:latest"
    args:
    - -c
--- a/charts/generic/pod-network-loss/rbac.yaml
+++ b/charts/generic/pod-network-loss/rbac.yaml
@@ -17,6 +17,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
  resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
  verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding