feat(permissions): Adding node as a resource in RBAC (#193)

Signed-off-by: shubhamchaudhary <shubham.chaudhary@mayadata.io>

charts/generic/container-kill/experiment.yaml

@@ -31,6 +31,13 @@ spec:
           - "update"
           - "patch"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/container-kill/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch","apps"]
   resources: ["pods","jobs","daemonsets","pods/exec","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/container-kill/rbac_nginx_getstarted.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch","apps"]
   resources: ["pods","jobs","daemonsets","pods/exec","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/disk-fill/experiment.yaml

@@ -32,6 +32,13 @@ spec:
           - "patch"
           - "update"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/disk-fill/rbac.yaml

@@ -17,6 +17,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch"]
   resources: ["pods","jobs","pods/exec","events","pods/log","daemonsets","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/generic/node-cpu-hog/experiment.yaml

@@ -35,7 +35,7 @@ spec:
           - ""
         resources: 
           - "nodes"
-        verbs :
+        verbs:
           - "get"
           - "list"
     image: "litmuschaos/ansible-runner:latest"

charts/generic/node-cpu-hog/rbac.yaml

@@ -19,7 +19,7 @@ rules:
   verbs: ["create","list","get","patch","update","delete"]
 - apiGroups: [""]
   resources: ["nodes"]
-  verbs : ["get","list"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/generic/node-drain/experiment.yaml

@@ -37,7 +37,7 @@ spec:
           - ""
         resources: 
           - "nodes"
-        verbs :
+        verbs:
           - "get"
           - "list"
           - "patch"

charts/generic/node-memory-hog/experiment.yaml

@@ -34,7 +34,7 @@ spec:
           - ""
         resources: 
           - "nodes"
-        verbs :
+        verbs:
           - "get"
           - "list"
     image: "litmuschaos/ansible-runner:latest"

charts/generic/node-memory-hog/rbac.yaml

@@ -19,7 +19,7 @@ rules:
   verbs: ["create","list","get","patch","update","delete"]
 - apiGroups: [""]
   resources: ["nodes"]
-  verbs : ["get","list"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/generic/pod-cpu-hog/experiment.yaml

@@ -29,6 +29,13 @@ spec:
           - "patch"
           - "update"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/pod-cpu-hog/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
   resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/pod-delete/experiment.yaml

@@ -36,7 +36,7 @@ spec:
           - ""
         resources: 
           - "nodes"
-        verbs :
+        verbs:
           - "get"
           - "list"
     image: "litmuschaos/ansible-runner:latest"

charts/generic/pod-delete/rbac.yaml

@@ -20,7 +20,7 @@ rules:
   verbs: ["create","list","get","patch","update","delete"]
 - apiGroups: [""]
   resources: ["nodes"]
-  verbs : ["get","list"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/pod-network-corruption/experiment.yaml

@@ -29,6 +29,13 @@ spec:
           - "patch"
           - "update"
           - "get"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/pod-network-corruption/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
   resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/pod-network-latency/experiment.yaml

@@ -29,6 +29,13 @@ spec:
           - "patch"
           - "update"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/pod-network-latency/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
   resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/generic/pod-network-loss/experiment.yaml

@@ -11,24 +11,31 @@ spec:
     scope: Namespaced
     permissions:
     - apiGroups:
-      - ""
+        - ""
-      - "batch"
+        - "batch"
-      - "litmuschaos.io"
+        - "litmuschaos.io"
       resources:
-      - "jobs"
+        - "jobs"
-      - "pods"
+        - "pods"
-      - "pods/log"
+        - "pods/log"
-      - "events"
+        - "events"
-      - "chaosengines"
+        - "chaosengines"
-      - "chaosexperiments"
+        - "chaosexperiments"
-      - "chaosresults"
+        - "chaosresults"
       verbs:
-      - "get"
+        - "get"
-      - "list"
+        - "list"
-      - "patch"
+        - "patch"
-      - "create"
+        - "create"
-      - "update"
+        - "update"
-      - "delete"
+        - "delete"
+    - apiGroups:
+        - ""
+      resources: 
+        - "nodes"
+      verbs:
+        - "get"
+        - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/generic/pod-network-loss/rbac.yaml

@@ -17,6 +17,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch"]
   resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/kafka/kafka-broker-pod-failure/experiment.yaml

@@ -37,7 +37,7 @@ spec:
           - ""
         resources: 
           - "nodes"
-        verbs :
+        verbs:
           - "get"
           - "list"
     image: "litmuschaos/ansible-runner:latest"

charts/kafka/kafka-broker-pod-failure/rbac.yaml

@@ -18,7 +18,7 @@ rules:
   verbs: ["create","list","get","patch","delete"]
 - apiGroups: [""]
   resources: ["nodes"]
-  verbs : ["get","list"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-control-plane-chaos/rbac.yaml

@@ -20,7 +20,7 @@ rules:
   verbs: ["create","list","get","patch","update","delete"]
 - apiGroups: [""]
   resources: ["nodes"]
-  verbs : ["get","list"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding

charts/openebs/openebs-pool-container-failure/experiment.yaml

@@ -43,6 +43,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-pool-container-failure/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io","openebs.io"]
   resources: ["pods","jobs","daemonsets","events","pods/log","replicasets","pods/exec","configmaps","secrets","persistentvolumeclaims","cstorvolumereplicas","chaosexperiments","chaosresults","chaosengines"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-pool-network-delay/experiment.yaml

@@ -45,6 +45,13 @@ spec:
           - "patch"
           - "update"
           - "delete"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-pool-network-delay/rbac.yaml

@@ -17,6 +17,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io","openebs.io"]
   resources: ["pods","pods/exec","pods/log","events","jobs","configmaps","services","persistentvolumeclaims","storageclasses","persistentvolumes","chaosengines","chaosexperiments","chaosresults","cstorpools","cstorvolumereplicas","replicasets"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-pool-network-loss/experiment.yaml

@@ -45,6 +45,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-pool-network-loss/rbac.yaml

@@ -15,39 +15,12 @@ metadata:
   labels:
     name: pool-network-loss-sa
 rules:
-- apiGroups:
+- apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io","openebs.io"]
-    - ""
+  resources: ["pods","pods/exec","pods/log","events","jobs","configmaps","services","persistentvolumeclaims","storageclasses","persistentvolumes","chaosengines","chaosexperiments","chaosresults","cstorpools","cstorvolumereplicas","replicasets"]
-    - "apps"
+  verbs: ["create","list","get","patch","update","delete"]
-    - "litmuschaos.io"
+- apiGroups: [""]
-    - "batch"
+  resources: ["nodes"]
-    - "extensions"
+  verbs: ["get","list"]
-    - "storage.k8s.io"
-    - "openebs.io"
-  resources:
-    - "pods"
-    - "pods/exec"
-    - "jobs"
-    - "pods/log"
-    - "events"
-    - "configmaps"
-    - "services"
-    - "persistentvolumeclaims"
-    - "storageclasses"
-    - "persistentvolumeclaims"
-    - "persistentvolumes"
-    - "chaosengines"
-    - "chaosexperiments"
-    - "chaosresults"
-    - "cstorpools"
-    - "cstorvolumereplicas"
-    - "replicasets"
-  verbs:
-    - "create"
-    - "get"
-    - "delete"
-    - "list"
-    - "patch"
-    - "update"
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-target-container-failure/experiment.yaml

@@ -41,6 +41,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-target-container-failure/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","litmuschaos.io","batch","apps","storage.k8s.io"]
   resources: ["pods","jobs","pods/log","pods/exec","daemonsets","events","configmaps","secrets","persistentvolumeclaims","storageclasses","persistentvolumes","chaosengines","chaosexperiments","chaosresults"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-target-network-delay/experiment.yaml

@@ -41,6 +41,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-target-network-delay/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io"]
   resources: ["pods","pods/exec","pods/log","events","jobs","configmaps","secrets","services","persistentvolumeclaims","storageclasses","persistentvolumes","chaosexperiments","chaosresults","chaosengines"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

charts/openebs/openebs-target-network-loss/experiment.yaml

@@ -41,6 +41,13 @@ spec:
           - "list"
           - "patch"
           - "update"
+      - apiGroups:
+          - ""
+        resources: 
+          - "nodes"
+        verbs:
+          - "get"
+          - "list"
     image: "litmuschaos/ansible-runner:latest"
     args:
     - -c

charts/openebs/openebs-target-network-loss/rbac.yaml

@@ -18,6 +18,9 @@ rules:
 - apiGroups: ["","apps","litmuschaos.io","batch","extensions","storage.k8s.io"]
   resources: ["pods","pods/exec","pods/log","events","jobs","configmaps","secrets","services","persistentvolumeclaims","storageclasses","persistentvolumes","chaosexperiments","chaosresults","chaosengines"]
   verbs: ["create","list","get","patch","update","delete"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get","list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding