role binding : apiGroup definition instead of namespace

[heurtematte]

As part of the definition of "rbac.authorization.k8s.io/v1", namespace attribute doesn't exist on RoleRef and Subjects attributes definition. Instead it must be the attribut "apiGroup".

Example : https://github.com/eclipse-cbi/jiro/blob/master/instances/automotive.mdmbl/target/k8s/role-binding.json
should be :

"roleRef": {
      "kind": "Role",
      "name": "jenkins-master-owner",
      "apiGroup": "my_api_group"    <=== here
   },
   "subjects": [
      {
         "kind": "ServiceAccount",
         "name": "mdmbl",
         "apiGroup": "my_api_group"         <=== here
      }
   ]

And apiGroup should have a name: https://github.com/eclipse-cbi/jiro/blob/master/instances/automotive.mdmbl/target/k8s/role.json

   "rules": [
      {
         "apiGroups": [
            "my_api_group"             <=== here
         ],
         "resources": [
            "pods",
            "pods/exec"
         ],

[fredg02]

References:

• https://docs.openshift.com/container-platform/4.8/rest_api/rbac_apis/rolebinding-rbac-authorization-k8s-io-v1.html
• https://docs.openshift.com/container-platform/4.8/rest_api/rbac_apis/role-rbac-authorization-k8s-io-v1.html

@mbarbero do you know how the namespace attribute ended up there instead of the apiGroup attribute?

[mbarbero]

There is a difference between a clusterrolebinding and a rolebinding (as there is for role and clusterrole). A clusterrolebinding is not namespaced, ie it applies to the whole cluster, while a rolebinding is only about a specific namespace. It's very important to keep those a rolebinding and not clusterrolebinding and as such to keep the namespace part, otherwise you will grant permission to the whole cluster 😱

[mbarbero]

My bad, I read this one too quickly.

IIRC, namespace in roleref was something in the beta version of the RBAC API rbac.authorization.k8s.io/v1. It may still be accepted for backward compatibility reason.

Regarding apiGroups, the core one does not need to be specified (see https://kubernetes.io/docs/reference/using-api/#api-groups)