feat(auth): reset abac policy (#1155)

tkestack · Mar 25, 2021 · 4e7d3b5 · 4e7d3b5
1 parent b08fc5b
commit 4e7d3b5
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 5 deletions.
diff --git a/charts/tke-auth-api/templates/configmap.yaml b/charts/tke-auth-api/templates/configmap.yaml
@@ -6,8 +6,7 @@ metadata:
  {{- include "tke-auth-api.labels" . | nindent 4 }}
 data:
  abac-policy.json: |
- {"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:kube-*|system:serviceaccount:kube-system:*","namespace":"*", "resource":"*","apiGroup":"*tkestack.io", "group": "*", "nonResourcePath":"*"}}
- {"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"^system:serviceaccount:tke:default$","namespace":"*", "resource":"*","apiGroup":"*", "group": "*", "nonResourcePath":"*"}}
+ {"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:*","namespace":"*", "resource":"*","apiGroup":"*", "group": "*", "nonResourcePath":"*"}}
  tke-auth-api.toml: |
  [secure_serving]
  tls_cert_file = "/app/certs/tke-auth-api/tls.crt"

diff --git a/cmd/tke-installer/app/installer/manifests/tke-auth-api/tke-auth-api.yaml b/cmd/tke-installer/app/installer/manifests/tke-auth-api/tke-auth-api.yaml
@@ -86,8 +86,7 @@ metadata:
  namespace: tke
 data:
  abac-policy.json: |
- {"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:kube-*|system:serviceaccount:kube-system:*","namespace":"*", "resource":"*","apiGroup":"*tkestack.io", "group": "*", "nonResourcePath":"*"}}
- {"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"^system:serviceaccount:tke:default$","namespace":"*", "resource":"*","apiGroup":"*", "group": "*", "nonResourcePath":"*"}}
+ {"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:*","namespace":"*", "resource":"*","apiGroup":"*", "group": "*", "nonResourcePath":"*"}}
  tke-auth-api.toml: |
  [secure_serving]
  tls_cert_file = "/app/certs/server.crt"
@@ -159,4 +158,4 @@ data:
  cluster: tke
  name: tke
 
-{{- end }}
+{{- end }}