101 lines
2.6 KiB
YAML
101 lines
2.6 KiB
YAML
|
# spring-cloud-kubernetes 是在 Pod 里调 K8s API 去读 ConfigMap 的，
|
|||
|
|
# 默认的 default ServiceAccount 没有这个权限——漏了这份清单，应用启动时读配置会 403，
|
|||
|
|
# 而且 reload 的轮询会每 15 秒报一次错（见 07-config-governance.md「关键规则」）。
|
|||
|
|
#
|
|||
|
|
# 权限严格收敛到"读所在 namespace 的 ConfigMap"这一件事：
|
|||
|
|
# - 不给 secrets 的 get/list：Secret 是通过 envFrom 由 kubelet 注入的，应用自己不需要读；
|
|||
|
|
# 给了反而等于让一次 RCE 直接拿到 JWT 签名密钥。
|
|||
|
|
# - 用 Role 而不是 ClusterRole：跨 namespace 读不到，UAT 的 Pod 看不见 Prod 的配置。
|
|||
|
|
# - reload 用的是 mode: polling 而不是 event，所以不需要 watch 权限。
|
|||
|
|
#
|
|||
|
|
# 三个 namespace 各一份，内容相同。
|
|||
|
|
apiVersion: v1
|
|||
|
|
kind: ServiceAccount
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend
|
|||
|
|
namespace: retailapp-dev
|
|||
|
|
---
|
|||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|||
|
|
kind: Role
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
namespace: retailapp-dev
|
|||
|
|
rules:
|
|||
|
|
- apiGroups: [""]
|
|||
|
|
resources: ["configmaps"]
|
|||
|
|
verbs: ["get", "list"]
|
|||
|
|
---
|
|||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|||
|
|
kind: RoleBinding
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
namespace: retailapp-dev
|
|||
|
|
roleRef:
|
|||
|
|
apiGroup: rbac.authorization.k8s.io
|
|||
|
|
kind: Role
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
subjects:
|
|||
|
|
- kind: ServiceAccount
|
|||
|
|
name: conti-backend
|
|||
|
|
namespace: retailapp-dev
|
|||
|
|
---
|
|||
|
|
apiVersion: v1
|
|||
|
|
kind: ServiceAccount
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend
|
|||
|
|
namespace: retailapp-uat
|
|||
|
|
---
|
|||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|||
|
|
kind: Role
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
namespace: retailapp-uat
|
|||
|
|
rules:
|
|||
|
|
- apiGroups: [""]
|
|||
|
|
resources: ["configmaps"]
|
|||
|
|
verbs: ["get", "list"]
|
|||
|
|
---
|
|||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|||
|
|
kind: RoleBinding
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
namespace: retailapp-uat
|
|||
|
|
roleRef:
|
|||
|
|
apiGroup: rbac.authorization.k8s.io
|
|||
|
|
kind: Role
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
subjects:
|
|||
|
|
- kind: ServiceAccount
|
|||
|
|
name: conti-backend
|
|||
|
|
namespace: retailapp-uat
|
|||
|
|
---
|
|||
|
|
apiVersion: v1
|
|||
|
|
kind: ServiceAccount
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend
|
|||
|
|
namespace: retailapp-prod
|
|||
|
|
---
|
|||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|||
|
|
kind: Role
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
namespace: retailapp-prod
|
|||
|
|
rules:
|
|||
|
|
- apiGroups: [""]
|
|||
|
|
resources: ["configmaps"]
|
|||
|
|
verbs: ["get", "list"]
|
|||
|
|
---
|
|||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|||
|
|
kind: RoleBinding
|
|||
|
|
metadata:
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
namespace: retailapp-prod
|
|||
|
|
roleRef:
|
|||
|
|
apiGroup: rbac.authorization.k8s.io
|
|||
|
|
kind: Role
|
|||
|
|
name: conti-backend-config-reader
|
|||
|
|
subjects:
|
|||
|
|
- kind: ServiceAccount
|
|||
|
|
name: conti-backend
|
|||
|
|
namespace: retailapp-prod
|