DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

rbac-nginx: resourceNames cannot filter create verb

Browse source
This commit is contained in:
Andrey Arapov 2017-06-03 11:24:35 +02:00
parent 4c868cf62a
commit 4618fd2f64
No known key found for this signature in database
GPG key ID: 368DDA2E9A471EAC
2 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
examples/rbac/nginx/README.md
View file

@ -53,7 +53,13 @@ permissions are granted to the Role named `nginx-ingress-role`
Furthermore to support leader-election, the nginx-ingress-controller needs to
have access to a `configmap` using the resourceName `ingress-controller-leader-nginx`
* `configmaps`: create, get, update (for resourceName `ingress-controller-leader-nginx`)
> Note that resourceNames can NOT be used to limit requests using the “create”
> verb because authorizers only have access to information that can be obtained
> from the request URL, method, and headers (resource names in a “create” request
> are part of the request body).
* `configmaps`: get, update (for resourceName `ingress-controller-leader-nginx`)
* `configmaps`: create
This resourceName is the concatenation of the `election-id` and the
`ingress-class` as defined by the ingress-controller, which default to: