Remove self-deletion permissions from kubelets

lzqmyb · Nov 14, 2018 · 8d7cc39 · 8d7cc39
1 parent d00cb23
commit 8d7cc39
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 4 deletions.
diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
@@ -107,7 +107,7 @@ func NodeRules() []rbacv1.PolicyRule {
 		// Use the NodeRestriction admission plugin to limit a node to creating/updating its own API object.
 		rbacv1helpers.NewRule("create", "get", "list", "watch").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
 		rbacv1helpers.NewRule("update", "patch").Groups(legacyGroup).Resources("nodes/status").RuleOrDie(),
-		rbacv1helpers.NewRule("update", "patch", "delete").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
+		rbacv1helpers.NewRule("update", "patch").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
 
 		// TODO: restrict to the bound node as creator in the NodeRestrictions admission plugin
 		rbacv1helpers.NewRule("create", "update", "patch").Groups(legacyGroup).Resources("events").RuleOrDie(),

diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
@@ -882,7 +882,6 @@ items:
     resources:
     - nodes
     verbs:
-    - delete
     - patch
     - update
   - apiGroups:

diff --git a/test/integration/auth/node_test.go b/test/integration/auth/node_test.go
@@ -530,7 +530,10 @@ func TestNodeAuthorizer(t *testing.T) {
 	expectAllowed(t, createNode2MirrorPodEviction(node2Client))
 	expectAllowed(t, createNode2(node2Client))
 	expectAllowed(t, updateNode2Status(node2Client))
-	expectAllowed(t, deleteNode2(node2Client))
+	// self deletion is not allowed
+	expectForbidden(t, deleteNode2(node2Client))
+	// clean up node2
+	expectAllowed(t, deleteNode2(superuserClient))
 
 	// create a pod as an admin to add object references
 	expectAllowed(t, createNode2NormalPod(superuserClient))
@@ -621,7 +624,7 @@ func TestNodeAuthorizer(t *testing.T) {
 	// node2 can no longer get the configmap after it is unassigned as its config source
 	expectForbidden(t, getConfigMapConfigSource(node2Client))
 	// clean up node2
-	expectAllowed(t, deleteNode2(node2Client))
+	expectAllowed(t, deleteNode2(superuserClient))
 
 	//TODO(mikedanese): integration test node restriction of TokenRequest
-Original file line number
+Diff line change
@@ Expand Up / @@ -882,7 +882,6 @@ items: @@
         resources:
         - nodes
         verbs:
-        - delete
         - patch
         - update
       - apiGroups:
@@ Expand Down @@