Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use token based approach for system-agent #769

Merged
merged 2 commits into from
Oct 24, 2024
Merged

Use token based approach for system-agent #769

merged 2 commits into from
Oct 24, 2024

Commits on Oct 24, 2024

  1. Use token based approach for system-agent 

    Reduce the footprint of the system-agent RBAC
Per each cluster there will be created:
- 1 system-agent ServiceAccount

Per each plan there will be temporarily created:
- 1 Role with access to all plan secrets for each machine
- 1 Rolebinging for the role and the cluster system-agent ServiceAccount
On plan completion/failure the role and rolebinding will be rewoked

Per each machine there will be created:
- 1 Secret for the system-agent authentication, with unique JWT bound to
  the secret existence in the API server, and a namespace/name pointer
  to the plan secret
- 1 Secret for the plan execution

Signed-off-by: Danil-Grigorev <[email protected]>
    @Danil-Grigorev
    Danil-Grigorev committed Oct 24, 2024
    Configuration menu
    Copy the full SHA
    d96b0f5 View commit details
    Browse the repository at this point in the history

  2. Update tests for webhook 

    Signed-off-by: Danil-Grigorev <[email protected]>
    @Danil-Grigorev
    Danil-Grigorev committed Oct 24, 2024
    Configuration menu
    Copy the full SHA
    32dc863 View commit details
    Browse the repository at this point in the history