Skip to content

Commit 7b2169b

Browse files
zhzhuang-zjuzhzhuang-zju
committed
Standardize the naming conventions for karmada system roles
Signed-off-by: zhzhuang-zju <[email protected]>
1 parent 3c34df8 commit 7b2169b

File tree

7 files changed

+69
-61
lines changed

7 files changed

+69
-61
lines changed

‎artifacts/deploy/bootstrap-token-configuration.yaml

Lines changed: 34 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ data:
1616
apiVersion: rbac.authorization.k8s.io/v1
1717
kind: Role
1818
metadata:
19-
name: karmada:bootstrap-signer-clusterinfo
19+
name: system:karmada:bootstrap-signer-clusterinfo
2020
namespace: kube-public
2121
rules:
2222
- apiGroups:
@@ -32,117 +32,124 @@ rules:
3232
apiVersion: rbac.authorization.k8s.io/v1
3333
kind: RoleBinding
3434
metadata:
35-
name: karmada:bootstrap-signer-clusterinfo
35+
name: system:karmada:bootstrap-signer-clusterinfo
3636
namespace: kube-public
3737
roleRef:
3838
apiGroup: rbac.authorization.k8s.io
3939
kind: Role
40-
name: karmada:bootstrap-signer-clusterinfo
40+
name: system:karmada:bootstrap-signer-clusterinfo
4141
subjects:
4242
- apiGroup: rbac.authorization.k8s.io
4343
kind: User
4444
name: system:anonymous
4545

4646
---
47+
# Group `system:karmada:bootstrappers:default-cluster-token` is the user group of the bootstrap token
48+
# used by `karmadactl register` when registering a new pull mode cluster.
4749
apiVersion: rbac.authorization.k8s.io/v1
4850
kind: ClusterRoleBinding
4951
metadata:
50-
name: karmada:agent-bootstrap
52+
name: system:karmada:agent-bootstrap
5153
roleRef:
5254
apiGroup: rbac.authorization.k8s.io
5355
kind: ClusterRole
5456
name: system:node-bootstrapper
5557
subjects:
5658
- apiGroup: rbac.authorization.k8s.io
5759
kind: Group
58-
name: system:bootstrappers:karmada:default-cluster-token
60+
name: system:karmada:bootstrappers:default-cluster-token
5961

6062
---
63+
# Define a ClusterRole with permissions to automatically approve the agent CSRs when the agentcsrapproving controller is enabled by karmada-controller-manager.
6164
apiVersion: rbac.authorization.k8s.io/v1
6265
kind: ClusterRole
6366
metadata:
64-
annotations:
65-
rbac.authorization.kubernetes.io/autoupdate: "true"
6667
labels:
67-
kubernetes.io/bootstrapping: rbac-defaults
68-
name: system:certificates.k8s.io:certificatesigningrequests:agent
68+
karmada.io/bootstrapping: rbac-defaults
69+
name: system:karmada:certificatesigningrequest:autoapprover
6970
rules:
7071
- apiGroups:
7172
- certificates.k8s.io
7273
resources:
73-
- certificatesigningrequests/agent
74+
- certificatesigningrequests/clusteragent
7475
verbs:
7576
- create
7677

7778
---
78-
# When the agentcsrapproving controller is enabled by the karmada-controller-manager, it can automatically approve the agent CSRs requested by the user group system:bootstrappers:karmada:default-cluster-token.
79+
# Group `system:karmada:bootstrappers:default-cluster-token` is the user group of the bootstrap token
80+
# used by `karmadactl register` when registering a new pull mode cluster.
81+
# When the `agentcsrapproving` controller is enabled by the karmada-controller-manager,
82+
# it can automatically approve the agent CSRs requested by the user group system:karmada:bootstrappers:default-cluster-token.
7983
apiVersion: rbac.authorization.k8s.io/v1
8084
kind: ClusterRoleBinding
8185
metadata:
82-
name: karmada:agent-autoapprove-bootstrap
86+
name: system:karmada:agent-autoapprove-bootstrap
8387
roleRef:
8488
apiGroup: rbac.authorization.k8s.io
8589
kind: ClusterRole
86-
name: system:certificates.k8s.io:certificatesigningrequests:agent
90+
name: system:karmada:certificatesigningrequest:autoapprover
8791
subjects:
8892
- apiGroup: rbac.authorization.k8s.io
8993
kind: Group
90-
name: system:bootstrappers:karmada:default-cluster-token
94+
name: system:karmada:bootstrappers:default-cluster-token
9195

9296
---
97+
# Define a ClusterRole with permissions to automatically approve the agent CSRs
98+
# where the user name and group of requester match those in the CSRs when the agentcsrapproving controller is enabled by karmada-controller-manager.
9399
apiVersion: rbac.authorization.k8s.io/v1
94100
kind: ClusterRole
95101
metadata:
96-
annotations:
97-
rbac.authorization.kubernetes.io/autoupdate: "true"
98102
labels:
99-
kubernetes.io/bootstrapping: rbac-defaults
100-
name: system:certificates.k8s.io:certificatesigningrequests:selfagent
103+
karmada.io/bootstrapping: rbac-defaults
104+
name: system:karmada:certificatesigningrequest:selfautoapprover
101105
rules:
102106
- apiGroups:
103107
- certificates.k8s.io
104108
resources:
105-
- certificatesigningrequests/selfagent
109+
- certificatesigningrequests/selfclusteragent
106110
verbs:
107111
- create
108112

109113
---
110-
# When the agentcsrapproving controller is enabled by the karmada-controller-manager, it can automatically approve the agent CSRs requested by the user group system:agents.
114+
# Group `system:karmada:agents` is the user group used by the karmada-agent to access the Karmada API server.
115+
# When the agentcsrapproving controller is enabled by the karmada-controller-manager, it can automatically approve
116+
# the agent CSRs(csr.Subject.CommonName = agent username) requested by the user group system:karmada:agents.
111117
apiVersion: rbac.authorization.k8s.io/v1
112118
kind: ClusterRoleBinding
113119
metadata:
114-
name: karmada:agent-autoapprove-certificate-rotation
120+
name: system:karmada:agent-autoapprove-certificate-rotation
115121
roleRef:
116122
apiGroup: rbac.authorization.k8s.io
117123
kind: ClusterRole
118-
name: system:certificates.k8s.io:certificatesigningrequests:selfagent
124+
name: system:karmada:certificatesigningrequest:selfautoapprover
119125
subjects:
120126
- apiGroup: rbac.authorization.k8s.io
121127
kind: Group
122-
name: system:agents
128+
name: system:karmada:agents
123129

124130
---
125-
# ClusterRole is not used for the connection between the karmada-agent and the control plane,
131+
# ClusterRole `system:karmada:agent-rbac-generator` is not used for the connection between the karmada-agent and the control plane,
126132
# but is used by karmadactl register to generate the RBAC resources required by the karmada-agent.
127133
apiVersion: rbac.authorization.k8s.io/v1
128134
kind: ClusterRole
129135
metadata:
130-
name: system:karmada:agent
136+
name: system:karmada:agent-rbac-generator
131137
rules:
132138
- apiGroups: ['*']
133139
resources: ['*']
134140
verbs: ['*']
135141

136142
---
143+
# User `system:karmada:agent:rbac-generator` is specifically used during the `karmadactl register` process to generate restricted RBAC resources for the `karmada-agent`.
137144
apiVersion: rbac.authorization.k8s.io/v1
138145
kind: ClusterRoleBinding
139146
metadata:
140147
name: system:karmada:agent-rbac-generator
141148
roleRef:
142149
apiGroup: rbac.authorization.k8s.io
143150
kind: ClusterRole
144-
name: system:karmada:agent
151+
name: system:karmada:agent-rbac-generator
145152
subjects:
146153
- apiGroup: rbac.authorization.k8s.io
147154
kind: User
148-
name: system:agent:agent-rbac-generator
155+
name: system:karmada:agent:rbac-generator

‎charts/karmada/templates/_karmada_bootstrap_token_configuration.tpl

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ data:
2323
apiVersion: rbac.authorization.k8s.io/v1
2424
kind: Role
2525
metadata:
26-
name: karmada:bootstrap-signer-clusterinfo
26+
name: system:karmada:bootstrap-signer-clusterinfo
2727
namespace: kube-public
2828
{{- if "karmada.commonLabels" }}
2929
labels:
@@ -42,7 +42,7 @@ rules:
4242
apiVersion: rbac.authorization.k8s.io/v1
4343
kind: RoleBinding
4444
metadata:
45-
name: karmada:bootstrap-signer-clusterinfo
45+
name: system:karmada:bootstrap-signer-clusterinfo
4646
namespace: kube-public
4747
{{- if "karmada.commonLabels" }}
4848
labels:
@@ -51,7 +51,7 @@ metadata:
5151
roleRef:
5252
apiGroup: rbac.authorization.k8s.io
5353
kind: Role
54-
name: karmada:bootstrap-signer-clusterinfo
54+
name: system:karmada:bootstrap-signer-clusterinfo
5555
subjects:
5656
- apiGroup: rbac.authorization.k8s.io
5757
kind: User
@@ -60,7 +60,7 @@ subjects:
6060
apiVersion: rbac.authorization.k8s.io/v1
6161
kind: ClusterRoleBinding
6262
metadata:
63-
name: karmada:agent-bootstrap
63+
name: system:karmada:agent-bootstrap
6464
{{- if "karmada.commonLabels" }}
6565
labels:
6666
{{- include "karmada.commonLabels" . | nindent 4 }}
@@ -72,12 +72,12 @@ roleRef:
7272
subjects:
7373
- apiGroup: rbac.authorization.k8s.io
7474
kind: Group
75-
name: system:bootstrappers:karmada:default-cluster-token
75+
name: system:karmada:bootstrappers:default-cluster-token
7676
---
7777
apiVersion: rbac.authorization.k8s.io/v1
7878
kind: ClusterRole
7979
metadata:
80-
name: system:certificates.k8s.io:certificatesigningrequests:agent
80+
name: system:karmada:certificatesigningrequest:autoapprover
8181
{{- if "karmada.commonLabels" }}
8282
labels:
8383
{{- include "karmada.commonLabels" . | nindent 4 }}
@@ -86,31 +86,31 @@ rules:
8686
- apiGroups:
8787
- certificates.k8s.io
8888
resources:
89-
- certificatesigningrequests/agent
89+
- certificatesigningrequests/clusteragent
9090
verbs:
9191
- create
9292
---
9393
apiVersion: rbac.authorization.k8s.io/v1
9494
kind: ClusterRoleBinding
9595
metadata:
96-
name: karmada:agent-autoapprove-bootstrap
96+
name: system:karmada:agent-autoapprove-bootstrap
9797
{{- if "karmada.commonLabels" }}
9898
labels:
9999
{{- include "karmada.commonLabels" . | nindent 4 }}
100100
{{- end }}
101101
roleRef:
102102
apiGroup: rbac.authorization.k8s.io
103103
kind: ClusterRole
104-
name: system:certificates.k8s.io:certificatesigningrequests:agent
104+
name: system:karmada:certificatesigningrequest:autoapprover
105105
subjects:
106106
- apiGroup: rbac.authorization.k8s.io
107107
kind: Group
108-
name: system:bootstrappers:karmada:default-cluster-token
108+
name: system:karmada:bootstrappers:default-cluster-token
109109
---
110110
apiVersion: rbac.authorization.k8s.io/v1
111111
kind: ClusterRole
112112
metadata:
113-
name: system:certificates.k8s.io:certificatesigningrequests:selfagent
113+
name: system:karmada:certificatesigningrequest:selfautoapprover
114114
{{- if "karmada.commonLabels" }}
115115
labels:
116116
{{- include "karmada.commonLabels" . | nindent 4 }}
@@ -119,31 +119,31 @@ rules:
119119
- apiGroups:
120120
- certificates.k8s.io
121121
resources:
122-
- certificatesigningrequests/selfagent
122+
- certificatesigningrequests/selfclusteragent
123123
verbs:
124124
- create
125125
---
126126
apiVersion: rbac.authorization.k8s.io/v1
127127
kind: ClusterRoleBinding
128128
metadata:
129-
name: karmada:agent-autoapprove-certificate-rotation
129+
name: system:karmada:agent-autoapprove-certificate-rotation
130130
{{- if "karmada.commonLabels" }}
131131
labels:
132132
{{- include "karmada.commonLabels" . | nindent 4 }}
133133
{{- end }}
134134
roleRef:
135135
apiGroup: rbac.authorization.k8s.io
136136
kind: ClusterRole
137-
name: system:certificates.k8s.io:certificatesigningrequests:selfagent
137+
name: system:karmada:certificatesigningrequest:selfautoapprover
138138
subjects:
139139
- apiGroup: rbac.authorization.k8s.io
140140
kind: Group
141-
name: system:agents
141+
name: system:karmada:agents
142142
---
143143
apiVersion: rbac.authorization.k8s.io/v1
144144
kind: ClusterRole
145145
metadata:
146-
name: system:karmada:agent
146+
name: system:karmada:agent-rbac-generator
147147
{{- if "karmada.commonLabels" }}
148148
labels:
149149
{{- include "karmada.commonLabels" . | nindent 4 }}
@@ -167,9 +167,9 @@ metadata:
167167
roleRef:
168168
apiGroup: rbac.authorization.k8s.io
169169
kind: ClusterRole
170-
name: system:karmada:agent
170+
name: system:karmada:agent-rbac-generator
171171
subjects:
172172
- apiGroup: rbac.authorization.k8s.io
173173
kind: User
174-
name: system:agent:agent-rbac-generator
174+
name: system:karmada:agent:rbac-generator
175175
{{- end -}}

‎pkg/karmadactl/cmdinit/bootstraptoken/agent/tlsbootstrap.go

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,19 +29,19 @@ const (
2929
// KarmadaAgentBootstrapperClusterRoleName defines the name of the auto-bootstrapped ClusterRole for letting someone post a CSR
3030
KarmadaAgentBootstrapperClusterRoleName = "system:node-bootstrapper"
3131
// KarmadaAgentBootstrap defines the name of the ClusterRoleBinding that lets Karmada Agent post CSRs
32-
KarmadaAgentBootstrap = "karmada:agent-bootstrap"
32+
KarmadaAgentBootstrap = "system:karmada:agent-bootstrap"
3333
// KarmadaAgentGroup defines the group of Karmada Agent
34-
KarmadaAgentGroup = "system:agents"
34+
KarmadaAgentGroup = "system:karmada:agents"
3535
// KarmadaAgentAutoApproveBootstrapClusterRoleBinding defines the name of the ClusterRoleBinding that makes the csrapprover approve agent CSRs
36-
KarmadaAgentAutoApproveBootstrapClusterRoleBinding = "karmada:agent-autoapprove-bootstrap"
36+
KarmadaAgentAutoApproveBootstrapClusterRoleBinding = "system:karmada:agent-autoapprove-bootstrap"
3737
// KarmadaAgentAutoApproveCertificateRotationClusterRoleBinding defines name of the ClusterRoleBinding that makes the csrapprover approve agent auto rotated CSRs
38-
KarmadaAgentAutoApproveCertificateRotationClusterRoleBinding = "karmada:agent-autoapprove-certificate-rotation"
38+
KarmadaAgentAutoApproveCertificateRotationClusterRoleBinding = "system:karmada:agent-autoapprove-certificate-rotation"
3939
// CSRAutoApprovalClusterRoleName defines the name of the auto-bootstrapped ClusterRole for making the csrapprover controller auto-approve the CSR
40-
CSRAutoApprovalClusterRoleName = "system:certificates.k8s.io:certificatesigningrequests:agent"
40+
CSRAutoApprovalClusterRoleName = "system:karmada:certificatesigningrequest:autoapprover"
4141
// KarmadaAgentSelfCSRAutoApprovalClusterRoleName is a role for automatic CSR approvals for automatically rotated agent certificates
42-
KarmadaAgentSelfCSRAutoApprovalClusterRoleName = "system:certificates.k8s.io:certificatesigningrequests:selfagent"
42+
KarmadaAgentSelfCSRAutoApprovalClusterRoleName = "system:karmada:certificatesigningrequest:selfautoapprover"
4343
// KarmadaAgentBootstrapTokenAuthGroup specifies which group a Karmada Agent Bootstrap Token should be authenticated in
44-
KarmadaAgentBootstrapTokenAuthGroup = "system:bootstrappers:karmada:default-cluster-token"
44+
KarmadaAgentBootstrapTokenAuthGroup = "system:karmada:bootstrappers:default-cluster-token"
4545
)
4646

4747
// AllowBootstrapTokensToPostCSRs creates RBAC rules in a way the makes Karmada Agent Bootstrap Tokens able to post CSRs
@@ -64,7 +64,7 @@ func AutoApproveKarmadaAgentBootstrapTokens(clientSet kubernetes.Interface) erro
6464
csrAutoApprovalClusterRole := utils.ClusterRoleFromRules(CSRAutoApprovalClusterRoleName, []rbacv1.PolicyRule{
6565
{
6666
APIGroups: []string{"certificates.k8s.io"},
67-
Resources: []string{"certificatesigningrequests/agent"},
67+
Resources: []string{"certificatesigningrequests/clusteragent"},
6868
Verbs: []string{"create"},
6969
},
7070
}, nil, nil)
@@ -89,7 +89,7 @@ func AutoApproveAgentCertificateRotation(clientSet kubernetes.Interface) error {
8989
karmadaAgentSelfCSRAutoApprovalClusterRole := utils.ClusterRoleFromRules(KarmadaAgentSelfCSRAutoApprovalClusterRoleName, []rbacv1.PolicyRule{
9090
{
9191
APIGroups: []string{"certificates.k8s.io"},
92-
Resources: []string{"certificatesigningrequests/selfagent"},
92+
Resources: []string{"certificatesigningrequests/selfclusteragent"},
9393
Verbs: []string{"create"},
9494
},
9595
}, nil, nil)

‎pkg/karmadactl/cmdinit/bootstraptoken/clusterinfo/clusterinfo.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ import (
3434

3535
const (
3636
// BootstrapSignerClusterRoleName sets the name for the ClusterRole that allows access to ConfigMaps in the kube-public ns
37-
BootstrapSignerClusterRoleName = "karmada:bootstrap-signer-clusterinfo"
37+
BootstrapSignerClusterRoleName = "system:karmada:bootstrap-signer-clusterinfo"
3838
)
3939

4040
// CreateBootstrapConfigMapIfNotExists creates the kube-public ConfigMap if it doesn't exist already

‎pkg/karmadactl/cmdinit/karmada/rbac.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@ import (
2828
const (
2929
karmadaViewClusterRole = "karmada-view"
3030
karmadaEditClusterRole = "karmada-edit"
31-
karmadaAgentRBACGeneratorClusterRole = "system:karmada:agent"
31+
karmadaAgentRBACGeneratorClusterRole = "system:karmada:agent-rbac-generator"
3232
karmadaAgentRBACGeneratorClusterRoleBinding = "system:karmada:agent-rbac-generator"
33-
agentRBACGenerator = "system:agent:agent-rbac-generator"
33+
agentRBACGenerator = "system:karmada:agent:rbac-generator"
3434
)
3535

3636
// grantProxyPermissionToAdmin grants the proxy permission to "system:admin"

‎pkg/karmadactl/register/register.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,11 @@ const (
8181
// CACertPath defines default location of CA certificate on Linux
8282
CACertPath = "/etc/karmada/pki/ca.crt"
8383
// ClusterPermissionPrefix defines the common name of karmada agent certificate
84-
ClusterPermissionPrefix = "system:agent:"
84+
ClusterPermissionPrefix = "system:karmada:agent:"
8585
// ClusterPermissionGroups defines the organization of karmada agent certificate
86-
ClusterPermissionGroups = "system:agents"
86+
ClusterPermissionGroups = "system:karmada:agents"
8787
// AgentRBACGenerator defines the common name of karmada agent rbac generator certificate
88-
AgentRBACGenerator = "system:agent:agent-rbac-generator"
88+
AgentRBACGenerator = "system:karmada:agent:rbac-generator"
8989
// KarmadaAgentBootstrapKubeConfigFileName defines the file name for the kubeconfig that the karmada-agent will use to do
9090
// the TLS bootstrap to get itself an unique credential
9191
KarmadaAgentBootstrapKubeConfigFileName = "bootstrap-karmada-agent.conf"
@@ -904,6 +904,7 @@ func (o *CommandRegisterOption) constructKubeConfig(bootstrapClient *kubeclient.
904904
}
905905

906906
klog.V(1).Infof(fmt.Sprintf("Waiting for the client certificate of csr %s to be issued", csrName))
907+
klog.V(1).Infof("Approve the CSR %s manually by executing `kubectl certificate approve %s` on the control plane", csrName, csrName)
907908
return false, nil
908909
})
909910
if err != nil {

‎pkg/karmadactl/util/bootstraptoken/bootstraptoken.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ var (
6161
// DefaultUsages is the default usages of bootstrap token
6262
DefaultUsages = bootstrapapi.KnownTokenUsages
6363
// DefaultGroups is the default groups of bootstrap token
64-
DefaultGroups = []string{"system:bootstrappers:karmada:default-cluster-token"}
64+
DefaultGroups = []string{"system:karmada:bootstrappers:default-cluster-token"}
6565
)
6666

6767
// BootstrapToken describes one bootstrap token, stored as a Secret in the cluster

0 commit comments

Comments
 (0)