Skip to content

Commit 9816f92

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #443 from mpatlasov/OCPBUGS-62802-Add-RBAC-permissions-for-secrets-and-nodes
OCPBUGS-62802: Add RBAC ClusterRole and Binding for driver node
2 parents 359c05b + a0d0a52 commit 9816f92

File tree

9 files changed

+99
-0
lines changed

9 files changed

+99
-0
lines changed

‎assets/overlays/azure-disk/base/node_driver_binding.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
kind: ClusterRoleBinding
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
metadata:
4+
name: azure-disk-csi-driver-node-clusterrolebinding
5+
subjects:
6+
- kind: ServiceAccount
7+
name: azure-disk-csi-driver-node-sa
8+
namespace: ${NODE_NAMESPACE}
9+
roleRef:
10+
kind: ClusterRole
11+
name: azure-disk-csi-driver-node-clusterrole
12+
apiGroup: rbac.authorization.k8s.io

‎assets/overlays/azure-disk/base/node_driver_role.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
kind: ClusterRole
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
metadata:
4+
name: azure-disk-csi-driver-node-clusterrole
5+
rules:
6+
# Upstream has a rule to get secrets here (https://github.com/kubernetes-sigs/azuredisk-csi-driver/blob/release-1.29/deploy/v1.29.0/rbac-csi-azuredisk-node.yaml),
7+
# but OCP doesn't. Such a rule is too broad, it gives the driver access to all secrets in the cluster. The OCP environment must be properly configured,
8+
# so fallback to get secrets with this rule is never needed.
9+
- apiGroups: [""]
10+
resources: ["nodes"]
11+
verbs: ["get"]

‎assets/overlays/azure-disk/generated/hypershift/manifests.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ guestStaticAssetNames:
1313
- main_resizer_binding.yaml
1414
- main_snapshotter_binding.yaml
1515
- node.yaml
16+
- node_driver_binding.yaml
17+
- node_driver_role.yaml
1618
- node_kube_rbac_proxy_binding.yaml
1719
- node_kube_rbac_proxy_role.yaml
1820
- node_privileged_binding.yaml

‎assets/overlays/azure-disk/generated/hypershift/node_driver_binding.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/azure-disk/base/node_driver_binding.yaml
4+
#
5+
#
6+
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRoleBinding
9+
metadata:
10+
name: azure-disk-csi-driver-node-clusterrolebinding
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: ClusterRole
14+
name: azure-disk-csi-driver-node-clusterrole
15+
subjects:
16+
- kind: ServiceAccount
17+
name: azure-disk-csi-driver-node-sa
18+
namespace: ${NODE_NAMESPACE}

‎assets/overlays/azure-disk/generated/hypershift/node_driver_role.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/azure-disk/base/node_driver_role.yaml
4+
#
5+
#
6+
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRole
9+
metadata:
10+
name: azure-disk-csi-driver-node-clusterrole
11+
rules:
12+
- apiGroups:
13+
- ""
14+
resources:
15+
- nodes
16+
verbs:
17+
- get

‎assets/overlays/azure-disk/generated/standalone/manifests.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ guestStaticAssetNames:
1818
- main_resizer_binding.yaml
1919
- main_snapshotter_binding.yaml
2020
- node.yaml
21+
- node_driver_binding.yaml
22+
- node_driver_role.yaml
2123
- node_kube_rbac_proxy_binding.yaml
2224
- node_kube_rbac_proxy_role.yaml
2325
- node_privileged_binding.yaml

‎assets/overlays/azure-disk/generated/standalone/node_driver_binding.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/azure-disk/base/node_driver_binding.yaml
4+
#
5+
#
6+
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRoleBinding
9+
metadata:
10+
name: azure-disk-csi-driver-node-clusterrolebinding
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: ClusterRole
14+
name: azure-disk-csi-driver-node-clusterrole
15+
subjects:
16+
- kind: ServiceAccount
17+
name: azure-disk-csi-driver-node-sa
18+
namespace: ${NODE_NAMESPACE}

‎assets/overlays/azure-disk/generated/standalone/node_driver_role.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/azure-disk/base/node_driver_role.yaml
4+
#
5+
#
6+
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRole
9+
metadata:
10+
name: azure-disk-csi-driver-node-clusterrole
11+
rules:
12+
- apiGroups:
13+
- ""
14+
resources:
15+
- nodes
16+
verbs:
17+
- get

‎pkg/driver/azure-disk/azure_disk.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,8 @@ func GetAzureDiskGeneratorConfig() *generator.CSIDriverGeneratorConfig {
131131
"overlays/azure-disk/base/csidriver.yaml",
132132
"overlays/azure-disk/base/storageclass.yaml",
133133
"overlays/azure-disk/base/volumesnapshotclass.yaml",
134+
"overlays/azure-disk/base/node_driver_role.yaml",
135+
"overlays/azure-disk/base/node_driver_binding.yaml",
134136
),
135137
},
136138
}

0 commit comments

Comments
 (0)