feat(permissions): Adding node as a resource in RBAC (#193)

Signed-off-by: shubhamchaudhary <shubham.chaudhary@mayadata.io>

charts/generic/container-kill/experiment.yaml

@@ -31,6 +31,13 @@ spec:
           - "update"
           - "patch"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/container-kill/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch","apps"]
   resources: ["pods","jobs","daemonsets","pods/exec","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/container-kill/rbac_nginx_getstarted.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch","apps"]
   resources: ["pods","jobs","daemonsets","pods/exec","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/disk-fill/experiment.yaml

@@ -32,6 +32,13 @@ spec:
           - "patch"
           - "update"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/disk-fill/rbac.yaml

@@ -17,6 +17,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch"]
   resources: ["pods","jobs","pods/exec","events","pods/log","daemonsets","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/generic/pod-cpu-hog/experiment.yaml

@@ -29,6 +29,13 @@ spec:
           - "patch"
           - "update"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/pod-cpu-hog/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
   resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/pod-network-corruption/experiment.yaml

@@ -29,6 +29,13 @@ spec:
           - "patch"
           - "update"
           - "get"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/pod-network-corruption/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
   resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/pod-network-latency/experiment.yaml

@@ -29,6 +29,13 @@ spec:
           - "patch"
           - "update"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/pod-network-latency/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
   resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/pod-network-loss/experiment.yaml

@@ -29,6 +29,13 @@ spec:
         - "create"
         - "update"
         - "delete"
+    - apiGroups:
+        - ""
+      resources: 
+        - "nodes"
+      verbs:
+        - "get"
+        - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/pod-network-loss/rbac.yaml

@@ -17,6 +17,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
   resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/openebs/openebs-pool-container-failure/experiment.yaml

@@ -43,6 +43,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-pool-container-failure/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io","openebs.io"]
   resources: ["pods","jobs","daemonsets","events","pods/log","replicasets","pods/exec","configmaps","secrets","persistentvolumeclaims","cstorvolumereplicas","chaosexperiments","chaosresults","chaosengines"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-pool-network-delay/experiment.yaml

@@ -45,6 +45,13 @@ spec:
           - "patch"
           - "update"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-pool-network-delay/rbac.yaml

@@ -17,6 +17,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io","openebs.io"]
   resources: ["pods","pods/exec","pods/log","events","jobs","configmaps","services","persistentvolumeclaims","storageclasses","persistentvolumes","chaosengines","chaosexperiments","chaosresults","cstorpools","cstorvolumereplicas","replicasets"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-pool-network-loss/experiment.yaml

@@ -45,6 +45,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-pool-network-loss/rbac.yaml

@@ -15,39 +15,12 @@ metadata:
   labels:
     name: pool-network-loss-sa
 rules:
-- apiGroups:
+- apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io","openebs.io"]
-    - ""
+  resources: ["pods","pods/exec","pods/log","events","jobs","configmaps","services","persistentvolumeclaims","storageclasses","persistentvolumes","chaosengines","chaosexperiments","chaosresults","cstorpools","cstorvolumereplicas","replicasets"]
-    - "apps"
+  verbs: ["create","list","get","patch","update","delete"]
-    - "litmuschaos.io"
+- apiGroups: [""]
-    - "batch"
+  resources: ["nodes"]
-    - "extensions"
+  verbs: ["get","list"]
-    - "storage.k8s.io"
-    - "openebs.io"
-  resources:
-    - "pods"
-    - "pods/exec"
-    - "jobs"
-    - "pods/log"
-    - "events"
-    - "configmaps"
-    - "services"
-    - "persistentvolumeclaims"
-    - "storageclasses"
-    - "persistentvolumeclaims"
-    - "persistentvolumes"
-    - "chaosengines"
-    - "chaosexperiments"
-    - "chaosresults"
-    - "cstorpools"
-    - "cstorvolumereplicas"
-    - "replicasets"
-  verbs:
-    - "create"
-    - "get"
-    - "delete"
-    - "list"
-    - "patch"
-    - "update"
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-target-container-failure/experiment.yaml

@@ -41,6 +41,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-target-container-failure/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch","apps","storage.k8s.io"]
   resources: ["pods","jobs","pods/log","pods/exec","daemonsets","events","configmaps","secrets","persistentvolumeclaims","storageclasses","persistentvolumes","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-target-network-delay/experiment.yaml

@@ -41,6 +41,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-target-network-delay/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io"]
   resources: ["pods","pods/exec","pods/log","events","jobs","configmaps","secrets","services","persistentvolumeclaims","storageclasses","persistentvolumes","chaosexperiments","chaosresults","chaosengines"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-target-network-loss/experiment.yaml

@@ -41,6 +41,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-target-network-loss/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io"]
   resources: ["pods","pods/exec","pods/log","events","jobs","configmaps","secrets","services","persistentvolumeclaims","storageclasses","persistentvolumes","chaosexperiments","chaosresults","chaosengines"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding