From e2eaeae44f04b5b1a48d00753ff04fbd9fc160d5 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 26 Sep 2019 10:35:53 +0900 Subject: [PATCH] Add permissions for serving APIs to view and edit role This patch adds some permissions for knative serving API to edit and view role The `edit` and `view` roles are k8s's default [user-facing role](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles). So, Users should be able to assume that they can access or edit serving resources by using these roles. --- config/200-clusterrole-namespaced.yaml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/config/200-clusterrole-namespaced.yaml b/config/200-clusterrole-namespaced.yaml index 65046db39efd..5f5b0b65be5d 100644 --- a/config/200-clusterrole-namespaced.yaml +++ b/config/200-clusterrole-namespaced.yaml @@ -23,3 +23,27 @@ rules: - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev"] resources: ["*"] verbs: ["*"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-edit + labels: + rbac.authorization.k8s.io/aggregate-to-edit: "true" + serving.knative.dev/release: devel +rules: + - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev"] + resources: ["*"] + verbs: ["create", "update", "patch", "delete"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-view + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + serving.knative.dev/release: devel +rules: + - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"]