update rbac for hpa custom metrics (#484)

vesoft-inc · Mar 26, 2024 · 18655c2 · 18655c2
1 parent 2666240
commit 18655c2
Show file tree

Hide file tree

Showing 4 changed files with 62 additions and 4 deletions.
diff --git a/apis/autoscaling/scheme/scheme.go b/apis/autoscaling/scheme/scheme.go
@@ -1,3 +1,19 @@
+/*
+Copyright 2023 Vesoft Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 package scheme
 
 import (

diff --git a/charts/nebula-operator/templates/controller-manager-rbac.yaml b/charts/nebula-operator/templates/controller-manager-rbac.yaml
@@ -362,7 +362,6 @@ rules:
     verbs:
       - get
       - list
-      - watch
   - apiGroups:
       - apiextensions.k8s.io
     resources:
@@ -374,6 +373,20 @@ rules:
       - update
       - patch
       - create
+  - apiGroups:
+      - custom.metrics.k8s.io
+    resources:
+      - '*'
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -390,4 +403,18 @@ subjects:
     name: {{ template "controller-manager.name" . }}-sa
     namespace: {{ template "nebula-operator.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "controller-manager.name" . }}:system:auth-delegator
+  labels:
+  {{- include "controller-manager.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: {{ template "controller-manager.name" . }}-sa
+  namespace: {{ template "nebula-operator.namespace" . }}
 {{- end }}
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -25,6 +25,13 @@ rules:
   - create
   - list
   - patch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
 - apiGroups:
   - ""
   resources:
@@ -279,14 +286,20 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - custom.metrics.k8s.io
+  resources:
+  - '*'
+  verbs:
+  - get
+  - list
 - apiGroups:
   - metrics.k8s.io
   resources:
   - pods
   verbs:
   - get
   - list
-  - watch
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

diff --git a/pkg/controller/autoscaler/autoscaler.go b/pkg/controller/autoscaler/autoscaler.go
@@ -186,8 +186,10 @@ func NewHorizontalController(
 	return hpaController, nil
 }
 
-// +kubebuilder:rbac:groups="metrics.k8s.io",resources=pods,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="custom.metrics.k8s.io",resources=*,verbs=get;list
+// +kubebuilder:rbac:groups="metrics.k8s.io",resources=pods,verbs=get;list
+// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch;list
 // +kubebuilder:rbac:groups=apps.nebula-graph.io,resources=nebulaclusters,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=apps.nebula-graph.io,resources=nebulaclusters/status,verbs=get;update;patch