Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Split controller RBAC into cluster-wide and tenant roles #2346

Merged
merged 1 commit into from Apr 15, 2020
Merged

Split controller RBAC into cluster-wide and tenant roles #2346

merged 1 commit into from Apr 15, 2020

Commits on Apr 8, 2020

  1. Split controller RBAC into cluster-wide and tenant roles 

    The controller currently operates with a single ClusterRole that
spans a very broad set of access permissions. In multi-tenant
scenarios this kind of RBAC configuration can be quite dangerous.

In order to better support potential multi-tenant configurations
this PR splits the roles that the controller receives into two.

This PR does not actually change the level of access afforded to
the controller. Instead, the roles are split but remain
cluster-scoped by default. There should be no noticeable change
in behaviour from the existing RBAC configuration in master.

If a team wanted to start running a multi-tenant service they
would be able to bind tekton-pipelines-controller-tenant-access
using a RoleBinding instead of a ClusterRoleBinding, thereby
limiting the access that the controller has to specific tenant
namespaces.

Full credit goes to to @eddie4941 for designing these changes!
    Scott committed Apr 8, 2020
    Configuration menu
    Copy the full SHA
    feea97d View commit details
    Browse the repository at this point in the history