Merge pull request #62562 from frodenas/automated-cherry-pick-of-#62146-upstream-release-1.10

Automatic merge from submit-queue. Automated cherry pick of #62146: Fix daemon-set-controller bootstrap RBAC policy Cherry pick of #62146 on release-1.10. #62146: Fix daemon-set-controller bootstrap RBAC policy

Merge pull request #62562 from frodenas/automated-cherry-pick-of-#62146-upstream-release-1.10
2154475e · Kubernetes Submit Queue · GitHub · f15083b1 · 42bfc695 · 2154475e
Unverified Commit 2154475e authored Apr 19, 2018 by Kubernetes Submit Queue Committed by GitHub Apr 19, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

controller_policy.go ...auth/authorizer/rbac/bootstrappolicy/controller_policy.go +1 -1

controller-roles.yaml ...rizer/rbac/bootstrappolicy/testdata/controller-roles.yaml +1 -0

No files found.
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
@@ -105,7 +105,7 @@ func buildControllerRoles() ([]rbac.ClusterRole, []rbac.ClusterRoleBinding) {
 			rbac.NewRule("list", "watch").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
 			rbac.NewRule("list", "watch", "create", "delete", "patch").Groups(legacyGroup).Resources("pods").RuleOrDie(),
 			rbac.NewRule("create").Groups(legacyGroup).Resources("pods/binding").RuleOrDie(),
-			rbac.NewRule("list", "watch", "create", "delete", "update", "patch").Groups(appsGroup).Resources("controllerrevisions").RuleOrDie(),
+			rbac.NewRule("get", "list", "watch", "create", "delete", "update", "patch").Groups(appsGroup).Resources("controllerrevisions").RuleOrDie(),
 			eventsRule(),
 		},
 	})

--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
@@ -239,6 +239,7 @@ items:
    verbs:
    - create
    - delete
+    - get
    - list
    - patch
    - update