Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added RBAC policies for deployment #12

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Added RBAC policies for deployment #12

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3bde9ba
Added RBAC policies for deployment
Apr 24, 2017
1d4d8e0
Removed namespace from manifests
Apr 24, 2017
498bd4c
Add svc accounts to manifests. Update deploy/undeploy scripts.
Apr 24, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,4 +47,7 @@ eval "${KUBECTL} create configmap es-config --from-file=es-config --dry-run -o y
eval "${KUBECTL} create configmap fluentd-config --from-file=docker/fluentd/td-agent.conf --dry-run -o yaml" | eval "${KUBECTL} apply -f -"
eval "${KUBECTL} create configmap kibana-config --from-file=kibana.yml --dry-run -o yaml" | eval "${KUBECTL} apply -f -"

## Install RBAC policies
eval "${KUBECTL} apply -f rbac"

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add the same for es5/deploy.sh?

I.e. create a ../rbac symlink and add eval "${KUBECTL} apply -f rbac"

I have plans to merge es5 and es2.x, but it still requires more testing.

Copy link
Author

@eugene-chow eugene-chow Apr 24, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. I also took the liberty to update the undeploy.sh scripts and add the serviceAccount directive to the manifests which I missed out earlier.

Btw, the RBAC manifests were meant for ES2. ES5 is missing the k8s-events-printer.yaml and es-fluentd-ds.yaml manifests present in ES2. Is the ES5 deployment ready for use? I tried it a few weeks back but it didn't run properly.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ES5 is ready to be used, but there is no proper webui yet.
I use it with kibana5 and x-pack so far.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok. i'll test it again soon. for now, the rbac rules may not work properly with ES5

eval "${KUBECTL} get pods $@"
Binary file added rbac/.DS_Store
View file
Open in desktop
Binary file not shown.
9 changes: 9 additions & 0 deletions rbac/es-client-r.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: Role
metadata:
name: es-client
rules:
- apiGroups: [""]
resources:
- endpoints
verbs: ["get", "list", "watch"]
12 changes: 12 additions & 0 deletions rbac/es-client-rb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: RoleBinding
metadata:
name: es-client
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: es-client
subjects:
- kind: ServiceAccount
name: es-client
namespace: logging
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Namespace logging or monitoring?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry. forgot to remove the namespace directive

4 changes: 4 additions & 0 deletions rbac/es-client-sa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: es-client
9 changes: 9 additions & 0 deletions rbac/es-data-r.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: Role
metadata:
name: es-data
rules:
- apiGroups: [""]
resources:
- endpoints
verbs: ["get", "list", "watch"]
12 changes: 12 additions & 0 deletions rbac/es-data-rb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: RoleBinding
metadata:
name: es-data
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: es-data
subjects:
- kind: ServiceAccount
name: es-data
namespace: logging
4 changes: 4 additions & 0 deletions rbac/es-data-sa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: es-data
9 changes: 9 additions & 0 deletions rbac/fluentd-cr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: ClusterRole
metadata:
name: fluentd
rules:
- apiGroups: [""]
resources:
- pods
verbs: ["get", "list", "watch"]
12 changes: 12 additions & 0 deletions rbac/fluentd-crb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: ClusterRoleBinding
metadata:
name: fluentd
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: fluentd
subjects:
- kind: ServiceAccount
name: fluentd
namespace: logging
4 changes: 4 additions & 0 deletions rbac/fluentd-sa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: fluentd
9 changes: 9 additions & 0 deletions rbac/k8s-events-printer-cr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: ClusterRole
metadata:
name: kubernetes-events-printer
rules:
- apiGroups: [""]
resources:
- events
verbs: ["get", "list", "watch"]
12 changes: 12 additions & 0 deletions rbac/k8s-events-printer-crb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: ClusterRoleBinding
metadata:
name: kubernetes-events-printer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kubernetes-events-printer
subjects:
- kind: ServiceAccount
name: kubernetes-events-printer
namespace: logging
4 changes: 4 additions & 0 deletions rbac/k8s-events-printer-sa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubernetes-events-printer