Merge pull request #68162 from tallclair/runtimeclass-rbac

Automatic merge from submit-queue (batch tested with PRs 67578, 68154, 68162, 65545). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md. Add RuntimeClass read permission for nodes **What this PR does / why we need it**: Add the necessary permissions for nodes to read RuntimeClasses when the feature gate is enabled. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: For kubernetes/features#585 **Release note**: Covered by #67737 ```release-note NONE ``` /sig node /sig auth /kind feature /priority important-soon /milestone v1.12

Merge pull request #68162 from tallclair/runtimeclass-rbac
7fc381cb · Kubernetes Submit Queue · GitHub · 0698e466 · 0c59d4db · 7fc381cb
Unverified Commit 7fc381cb authored Sep 01, 2018 by Kubernetes Submit Queue Committed by GitHub Sep 01, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 0 deletions

policy.go plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +5 -0

No files found.
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
@@ -165,6 +165,11 @@ func NodeRules() []rbacv1.PolicyRule {
 	if utilfeature.DefaultFeatureGate.Enabled(features.NodeLease) {
 		nodePolicyRules = append(nodePolicyRules, rbacv1helpers.NewRule("get", "create", "update", "patch", "delete").Groups("coordination.k8s.io").Resources("leases").RuleOrDie())
 	}
+
+	// RuntimeClass
+	if utilfeature.DefaultFeatureGate.Enabled(features.RuntimeClass) {
+		nodePolicyRules = append(nodePolicyRules, rbacv1helpers.NewRule("get", "list", "watch").Groups("node.k8s.io").Resources("runtimeclasses").RuleOrDie())
+	}
 	return nodePolicyRules
 }