Skip to content

K
k3s
Commit 8ab05191 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #39961 from liggitt/patch-permissions

Automatic merge from submit-queue Give replicaset controller patch permission on pods Needed for AdoptPod/ReleasePod Fixes denials seen in autoscaling test log: `RBAC DENY: user "system:serviceaccount:kube-system:replicaset-controller" groups [system:serviceaccounts system:serviceaccounts:kube-system system:authenticated] cannot "patch" on "pods./"`
parents 6defc303 4eee0b2b
Hide whitespace changes
Inline Side-by-side
Showing with 2 additions and 1 deletion
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
View file @ 8ab05191
......@@ -206,7 +206,7 @@ func init() {
Rules: []rbac.PolicyRule{
rbac.NewRule("get", "list", "watch", "update").Groups(extensionsGroup).Resources("replicasets").RuleOrDie(),
rbac.NewRule("update").Groups(extensionsGroup).Resources("replicasets/status").RuleOrDie(),
rbac.NewRule("list", "watch", "create", "delete").Groups(legacyGroup).Resources("pods").RuleOrDie(),
rbac.NewRule("list", "watch", "patch", "create", "delete").Groups(legacyGroup).Resources("pods").RuleOrDie(),
eventsRule(),
},
})
......
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
View file @ 8ab05191
......@@ -757,6 +757,7 @@ items:
- create
- delete
- list
- patch
- watch
- apiGroups:
- ""
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment