Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Grant cloud-controller-manager RBAC permissions for HTTP port access #937

Merged
merged 1 commit into from
Jun 6, 2024
Merged

Grant cloud-controller-manager RBAC permissions for HTTP port access #937

merged 1 commit into from
Jun 6, 2024

Conversation

aupadhyay3
Copy link
Contributor

@aupadhyay3 aupadhyay3 commented Jun 3, 2024 •
edited
Loading

Co-Authored-By: Eric Wolak [email protected]

What type of PR is this?
/kind bug

What this PR does / why we need it:
This PR adds to the RBAC configuration for the system:serviceaccount:kube-system:cloud-controller-manager by granting ability to create tokenreviews and subjectaccessreviews. This update enables the service account to validate client credentials allowing Prometheus to scrape metrics.

Which issue(s) this PR fixes: N/A

Special notes for your reviewer:
This fix came up while trying to utilize cloud-controller-manager metrics. While trying to get prometheus to authenticate with the cloud-controller-manager metrics port, we found that the serviceaccount:kube-system:cloud-controller-manager does not have the right RBAC to perform authentication and authorization checks which are needed to validate prometheus client credentials. Specifically, it’s missing the permissions to create tokenreviews and subjectaccessreviews. See these errors:

User "system:serviceaccount:kube-system:cloud-controller-manager" cannot create resource "tokenreviews" in API group "[authentication.k8s.io](http://authentication.k8s.io/)" at the cluster scope
User "system:serviceaccount:kube-system:cloud-controller-manager" cannot create resource "subjectaccessreviews" in API group "[authorization.k8s.io](http://authorization.k8s.io/)" at the cluster scope

After patching the RBAC to include these permissions, prometheus was able to talk to connect to AWS CCM and scrape its metrics.

Does this PR introduce a user-facing change?:

This update adds `tokenreviews` and `subjectaccessreviews` to the cloud controller manager service account's RBAC permissions, enabling it to authenticate and authorize any services accessing its HTTP port.

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/bug Categorizes issue or PR as related to a bug. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jun 3, 2024
@linux-foundation-easycla Linux Foundation: EasyCLA
Copy link

linux-foundation-easycla bot commented Jun 3, 2024 •
edited
Loading

CLA Signed


The committers listed above are authorized under a signed CLA.

@k8s-ci-robot k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jun 3, 2024
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If cloud-provider-aws contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 3, 2024
@k8s-ci-robot
Copy link
Contributor

Hi @aupadhyay3. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jun 3, 2024
@aupadhyay3 aupadhyay3 marked this pull request as ready for review June 4, 2024 15:28
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 4, 2024
@k8s-ci-robot k8s-ci-robot requested a review from hakman June 4, 2024 15:28
@cartermckinnon
Copy link
Contributor

Makes sense to me, thanks @aupadhyay3

/ok-to-test
/lgtm

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 5, 2024
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 5, 2024
@cartermckinnon
Copy link
Contributor

@aupadhyay3 can you add a release note block for this?

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jun 5, 2024
@aupadhyay3
Copy link
Contributor Author

@cartermckinnon Added the release note, let me know if it looks good.

@cartermckinnon
Copy link
Contributor

/lgtm
/approve

Thanks, @aupadhyay3!

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cartermckinnon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 6, 2024
@k8s-ci-robot k8s-ci-robot merged commit 3da706f into kubernetes:master Jun 6, 2024
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kishorj kishorj Awaiting requested review from kishorj

@olemarkus olemarkus Awaiting requested review from olemarkus

@hakman hakman Awaiting requested review from hakman

Assignees

@cartermckinnon cartermckinnon

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@aupadhyay3 @k8s-ci-robot @cartermckinnon