Adding RBAC support in kubernetes config

clipper_admin/clipper_admin/kubernetes/kubernetes_container_manager.py

@@ -41,6 +41,11 @@
         'deployment': 'prom_deployment.yaml',
         'config': 'prom_configmap.yaml'
     },
+    'rbac': {
+        'clusterrole': 'rbac_cluster_role.yaml',
+        'clusterrolebinding': 'rbac_cluster_role_binding.yaml',
+        'serviceaccount': 'rbac_service_account.yaml'
+    },
     'model': {
         'deployment': 'model-container-template.yaml'
     }
@@ -129,6 +134,7 @@ def __init__(self,
         configuration.assert_hostname = False
         self._k8s_v1 = client.CoreV1Api()
         self._k8s_beta = client.ExtensionsV1beta1Api()
+        self._k8s_rbac=client.RbacAuthorizationV1alpha1Api()
 
         # Create the template engine
         # Config: Any variable missing -> Error
@@ -181,6 +187,7 @@ def start_clipper(self,
                       qf_http_timeout_request,
                       qf_http_timeout_content,
                       num_frontend_replicas=1):
+        self._config_rbac()
         self._start_redis()
         self._start_mgmt(mgmt_frontend_image)
         self.num_frontend_replicas = num_frontend_replicas
@@ -308,6 +315,28 @@ def _start_prometheus(self):
             self._k8s_v1.create_namespaced_service(
                 body=service_data, namespace=self.k8s_namespace)
 
+    def _config_rbac(self):
+        with _pass_conflicts():
+            clusterrole_data = self._generate_config(
+                CONFIG_FILES['rbac']['clusterrole'],
+                cluster_name=self.cluster_name)
+            self._k8s_rbac.create_cluster_role(
+                body=clusterrole_data, namespace=self.k8s_namespace)
+
+        with _pass_conflicts():
+            clusterrolebinding_data = self._generate_config(
+                CONFIG_FILES['rbac']['clusterrolebinding'],
+                cluster_name=self.cluster_name)
+            self._k8s_rbac.create_cluster_role_binding(
+                body=clusterrolebinding_data, namespace=self.k8s_namespace)
+
+        with _pass_conflicts():
+            serviceaccount_data = self._generate_config(
+                CONFIG_FILES['rbac']['serviceaccount'],
+                cluster_name=self.cluster_name)
+            self._k8s_v1.create_namespaced_service(
+                body=serviceaccount_data, namespace=self.k8s_namespace)
+
     def _generate_config(self, file_path, **kwargs):
         template = self.template_engine.get_template(file_path)
         rendered = template.render(**kwargs)

clipper_admin/clipper_admin/kubernetes/rbac_cluster_role.yaml

@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: prometheus
+rules:
+- apiGroups: [""]
+  resources:
+  - nodes
+  - nodes/proxy
+  - services
+  - endpoints
+  - pods
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - extensions
+  resources:
+  - ingresses
+  verbs: ["get", "list", "watch"]
+- nonResourceURLs: ["/metrics"]
+  verbs: ["get"]

clipper_admin/clipper_admin/kubernetes/rbac_cluster_role_binding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: prometheus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus
+subjects:
+- kind: ServiceAccount
+  name: prometheus
+  namespace: default

clipper_admin/clipper_admin/kubernetes/rbac_service_account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: prometheus
+  namespace: default