diff --git a/AGENTS.md b/AGENTS.md index ac1f4e8e7..1bec75f86 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -20,6 +20,7 @@ CSO does **not** implement CSI drivers directly. It installs and manages the ope cluster-storage-operator/ ├── assets/ # Embedded static manifests (YAML) │ ├── csidriveroperators/ # Per-driver kustomize bases + generated output +│ │ ├── common/ # Shared csi-driver-operator-common-role ClusterRole + per-operator common ClusterRoleBindings │ │ ├── aws-ebs/ │ │ │ ├── base/ # Shared kustomize resources (SA, RBAC, CR, Deployment) │ │ │ ├── standalone/ # Standalone (non-HyperShift) overlay + patches @@ -41,6 +42,7 @@ cluster-storage-operator/ │ ├── image-references # All container images managed by this operator │ ├── 03_credentials_request_*.yaml # Cloud IAM permissions per CSI driver (see CredentialsRequest Changes) │ ├── 06_operator_cr.yaml # Storage CR — main CSO configuration (operator.openshift.io/v1 Storage) +│ ├── 08_0001_..._storage_role.yaml # CSO's own consolidated ClusterRole (union of applied operand RBAC + self-needs) │ ├── 08_operator_rbac.yaml # CSO's own ClusterRoleBinding │ ├── 09_sidecar-*.yaml # Shared RBAC for CSI sidecars (provisioner, attacher, etc.) │ ├── 10_deployment.yaml # CSO Deployment @@ -172,7 +174,30 @@ A PR review **must fail** if any of the following are true: ### RBAC Changes - RBAC files under `assets/csidriveroperators//base/` govern the CSI driver *operator*, not the driver itself. Verify the subject, namespace, and rules match the minimum needed. -- CSO itself currently runs with `cluster-admin` (`manifests/08_operator_rbac.yaml`) — this is a known open TODO, not a new concern introduced by a PR. +- **Shared CSI driver-operator common role** — the nine driver-operator ClusterRoles share a large common subset. That subset is factored out into a single ClusterRole and each operator's own file keeps only its *delta* (the rules not in the common role): + - `assets/csidriveroperators/common/clusterrole.yaml` defines the shared `csi-driver-operator-common-role` ClusterRole (the intersection of every driver-operator ClusterRole across the standalone and hypershift-guest topologies). + - `assets/csidriveroperators/common/-common-clusterrolebinding.yaml` (one per operator) binds each operator's ServiceAccount to `csi-driver-operator-common-role`. + - Each operator's own ClusterRole source file (e.g. `aws-ebs/base/05_clusterrole.yaml`) now holds **only its delta** — the rules NOT in the common role — still bound by the operator's existing ClusterRoleBinding. `common ∪ delta` equals the operator's original effective grant, so effective permissions are unchanged. + - Both assets are wired per operator via `StaticAssets` in `pkg/operator/csidriveroperator/csioperatorclient/.go` (in both the standalone and hypershift-guest blocks, where present). + - When editing a driver-operator's permissions: a rule needed by **all** operators belongs in `common/clusterrole.yaml`; a rule specific to one operator belongs in that operator's delta file. Do not duplicate a common rule into a delta. + - The common/delta split was derived manually by intersecting the operator ClusterRoles and subtracting the common set from each. If the set of operators or their rules changes, recompute the split manually and re-run `make update` so `generated/` reflects the shrunk operator ClusterRoles. +- **CSO Operator RBAC** — CSO runs with a single fine-grained ClusterRole instead of `cluster-admin`: + - `manifests/08_0001_cluster_storage_operator_storage_role.yaml` contains the ClusterRole `cluster-storage-operator-storage-role`. Because Kubernetes forbids privilege escalation (to apply a Role/ClusterRole you must already hold every permission it grants), this role is the **union of all operand RBAC CSO applies from `assets/`** (across standalone ∪ hypershift-guest) **merged with CSO's own runtime self-needs** — e.g. `clusteroperators/status`, `storages/status`, `storageclasses`, `clusterrolebindings`, `config.openshift.io` reads, and CRD management. + - The previous per-namespace Roles (`08_0002`..`08_0005`) and their RoleBindings (`08_0010`) have been **removed**: a single cluster-scoped ClusterRole covers the same operations cluster-wide. These files were never shipped in a release, so no deletion manifests are required. + - `manifests/08_0002_operator_rbac-delete.yaml` and `manifests/08_0002_operator_rbac-hypershift-delete.yaml` are retained — they delete the old `cluster-admin` binding during upgrade. + - When operand RBAC in `assets/` changes, the consolidated role must be updated by hand to preserve the invariant: everything CSO applies from `assets/` must be a subset of what this ClusterRole grants. Verify by cross-checking each applied Role/ClusterRole's rules against this role for both the standalone and hypershift-guest topologies. + - **Standalone path** (`manifests/08_operator_rbac.yaml`): + - Contains a deletion manifest (with `release.openshift.io/delete: "true"` annotation) pointing to the old `cluster-admin` binding + - Followed by a replacement ClusterRoleBinding pointing to `cluster-storage-operator-storage-role` + - CVO processes deletion first, then applies the replacement, avoiding immutable `roleRef` conflicts during upgrades + - **HyperShift path** (`manifests/08_operator_rbac-hypershift.yaml` + `manifests/08_0002_operator_rbac-hypershift-delete.yaml`): + - `08_operator_rbac-hypershift.yaml` is autogenerated via `make update` and must not be hand-edited + - `08_0002_operator_rbac-hypershift-delete.yaml` is a hand-maintained deletion manifest with `release.openshift.io/delete: "true"` annotation + - CVO processes both: deletion first from the delete manifest, then applies the autogenerated binding + - `manifests/08_operator_scc.yaml` — ClusterRoleBinding granting the `nonroot-v2` SecurityContextConstraint (required for pod scheduling). + - Permissions were discovered incrementally by deploying with empty RBAC and capturing "forbidden" errors from operator logs, ensuring only necessary permissions are granted. + - **Immutable field migration strategy:** ClusterRoleBinding `roleRef` is immutable after creation. Changing it requires deletion and replacement in the same CVO update cycle using `release.openshift.io/delete: "true"` annotation on the old binding. + - When reviewing RBAC changes, verify verbs are minimal and necessary — do not use `["*"]` for new permissions. Use resourceNames for secrets access when possible. - Sidecar RBAC for provisioner / attacher / resizer / snapshotter lives in `manifests/09_sidecar-*.yaml` and is shared across all drivers. Changes there affect every driver simultaneously. ### Adding a New CSI Driver diff --git a/assets/csidriveroperators/aws-ebs/base/05_clusterrole.yaml b/assets/csidriveroperators/aws-ebs/base/05_clusterrole.yaml index 89ec26154..d20b46b68 100644 --- a/assets/csidriveroperators/aws-ebs/base/05_clusterrole.yaml +++ b/assets/csidriveroperators/aws-ebs/base/05_clusterrole.yaml @@ -6,327 +6,73 @@ metadata: storage.openshift.io/remove-from: mgmt rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - # The Config Observer controller updates the CR's spec - - update - - patch -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers/status + - clusterversions + - featuregates verbs: - get - list - watch - - update - - patch - apiGroups: - - '' - resourceNames: - - extension-apiserver-authentication - - aws-ebs-csi-driver-operator-lock + - discovery.k8s.io resources: - - configmaps + - endpointslices verbs: - get - list - watch - - create - - update - - patch - - delete - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - '' + - storage.k8s.io resources: - - serviceaccounts + - volumeattachments/status verbs: - - get - - list - - watch - - create - - update - patch - - delete - apiGroups: - - apiextensions.k8s.io + - storage.k8s.io resources: - - customresourcedefinitions + - volumeattributesclasses verbs: - get - list - - create - watch - - delete - apiGroups: - - '' + - "" + resourceNames: + - aws-ebs-csi-driver-operator-lock resources: - - nodes + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - namespaces - verbs: - get - list - - watch - - create - patch - - delete - update -- apiGroups: - - '' - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - watch - - update - - patch - apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - '' - resources: - - pods - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps + - "" + resourceNames: + - extension-apiserver-authentication resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - get - list - - watch - - update - - delete - - create - - patch -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments/status - verbs: - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - watch - - update - - delete - apiGroups: - - storage.k8s.io + - "" resources: - - volumeattributesclasses - verbs: - - get - - list - - watch -- apiGroups: - - '*' - resources: - - events - verbs: - - get - - patch - - create - - list - - watch - - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses + - serviceaccounts verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - - featuregates - - clusterversions - verbs: - - get - - list - - watch -# Allow Prometheus to discover endpoints via EndpointSlices -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/aws-ebs/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/aws-ebs/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml index bb798ebdd..70db28b04 100644 --- a/assets/csidriveroperators/aws-ebs/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/aws-ebs/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml @@ -4,323 +4,73 @@ metadata: name: aws-ebs-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers + - clusterversions + - featuregates verbs: - get - list - watch - - update - - patch - apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - "" - resourceNames: - - extension-apiserver-authentication - - aws-ebs-csi-driver-operator-lock + - discovery.k8s.io resources: - - configmaps + - endpointslices verbs: - get - list - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update - apiGroups: - - "" + - storage.k8s.io resources: - - serviceaccounts + - volumeattachments/status verbs: - - get - - list - - watch - - create - - update - patch - - delete - apiGroups: - - apiextensions.k8s.io + - storage.k8s.io resources: - - customresourcedefinitions + - volumeattributesclasses verbs: - get - list - - create - watch - - delete - apiGroups: - "" + resourceNames: + - aws-ebs-csi-driver-operator-lock resources: - - nodes + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - get - list - - watch -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - create - patch - - delete - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - watch - - update - - patch - apiGroups: - "" + resourceNames: + - extension-apiserver-authentication resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - - get - - list - - watch - - update - - delete - - create - - patch -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments/status - verbs: - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes + - configmaps verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattributesclasses - verbs: - get - list - - watch -- apiGroups: - - '*' - resources: - - events - verbs: - - get - patch - - create - - list - - watch - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - - get - - list - watch - - create - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotcontents + - serviceaccounts verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - - featuregates - - clusterversions - verbs: - - get - - list - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/aws-ebs/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/aws-ebs/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml index bb798ebdd..70db28b04 100644 --- a/assets/csidriveroperators/aws-ebs/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/aws-ebs/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml @@ -4,323 +4,73 @@ metadata: name: aws-ebs-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers + - clusterversions + - featuregates verbs: - get - list - watch - - update - - patch - apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - "" - resourceNames: - - extension-apiserver-authentication - - aws-ebs-csi-driver-operator-lock + - discovery.k8s.io resources: - - configmaps + - endpointslices verbs: - get - list - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update - apiGroups: - - "" + - storage.k8s.io resources: - - serviceaccounts + - volumeattachments/status verbs: - - get - - list - - watch - - create - - update - patch - - delete - apiGroups: - - apiextensions.k8s.io + - storage.k8s.io resources: - - customresourcedefinitions + - volumeattributesclasses verbs: - get - list - - create - watch - - delete - apiGroups: - "" + resourceNames: + - aws-ebs-csi-driver-operator-lock resources: - - nodes + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - get - list - - watch -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - create - patch - - delete - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - watch - - update - - patch - apiGroups: - "" + resourceNames: + - extension-apiserver-authentication resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - - get - - list - - watch - - update - - delete - - create - - patch -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments/status - verbs: - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes + - configmaps verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattributesclasses - verbs: - get - list - - watch -- apiGroups: - - '*' - resources: - - events - verbs: - - get - patch - - create - - list - - watch - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - - get - - list - watch - - create - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotcontents + - serviceaccounts verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - - featuregates - - clusterversions - verbs: - - get - - list - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/azure-disk/base/06_clusterrole.yaml b/assets/csidriveroperators/azure-disk/base/06_clusterrole.yaml index b989feeb8..524f33d21 100644 --- a/assets/csidriveroperators/azure-disk/base/06_clusterrole.yaml +++ b/assets/csidriveroperators/azure-disk/base/06_clusterrole.yaml @@ -6,335 +6,81 @@ metadata: storage.openshift.io/remove-from: mgmt rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - # The Config Observer controller updates the CR's spec - - update - - patch -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers/status + - clusterversions + - featuregates verbs: - get - list - watch - - update - - patch - apiGroups: - - '' - resourceNames: - - extension-apiserver-authentication - - azure-disk-csi-driver-operator-lock + - discovery.k8s.io resources: - - configmaps + - endpointslices verbs: - get - list - watch - - create - - update - - patch - - delete -- apiGroups: - - '' - resources: - - configmaps - verbs: - - watch - - list - - get - apiGroups: - - rbac.authorization.k8s.io + - storage.k8s.io resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings + - volumeattachments/status verbs: - - watch - - list - - get - - create - - delete - patch - - update - apiGroups: - - '' + - storage.k8s.io resources: - - serviceaccounts + - volumeattributesclasses verbs: - get - list - watch - - create - - update - - patch - - delete - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete -- apiGroups: - - '' + - "" + resourceNames: + - azure-disk-csi-driver-operator-lock resources: - - nodes + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - namespaces - verbs: - get - list - - watch - - create - patch - - delete - update -- apiGroups: - - '' - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - watch - - update - - patch -- apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update - apiGroups: - - '' - resources: - - pods - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps + - "" + resourceNames: + - extension-apiserver-authentication resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - get - list - - watch - - update - - delete - - create - - patch -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments/status - verbs: - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - watch - - update - - delete - apiGroups: - - storage.k8s.io + - "" resources: - - volumeattributesclasses - verbs: - - get - - list - - watch -- apiGroups: - - '*' - resources: - - events - verbs: - - get - - patch - - create - - list - - watch - - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses + - configmaps verbs: - get - list - watch - - create - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotcontents + - serviceaccounts verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - clusterversions - - featuregates - - apiservers - verbs: - - get - - list - watch -# Allow Prometheus to discover endpoints via EndpointSlices -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/azure-disk/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/azure-disk/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml index 576e5d390..84319d768 100644 --- a/assets/csidriveroperators/azure-disk/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/azure-disk/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml @@ -4,331 +4,81 @@ metadata: name: azure-disk-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers/status + - clusterversions + - featuregates verbs: - get - list - watch - - update - - patch - apiGroups: - - "" - resourceNames: - - extension-apiserver-authentication - - azure-disk-csi-driver-operator-lock + - discovery.k8s.io resources: - - configmaps + - endpointslices verbs: - get - list - watch - - create - - update - - patch - - delete - apiGroups: - - "" - resources: - - configmaps - verbs: - - watch - - list - - get -- apiGroups: - - rbac.authorization.k8s.io + - storage.k8s.io resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings + - volumeattachments/status verbs: - - watch - - list - - get - - create - - delete - patch - - update - apiGroups: - - "" + - storage.k8s.io resources: - - serviceaccounts + - volumeattributesclasses verbs: - get - list - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete - apiGroups: - "" + resourceNames: + - azure-disk-csi-driver-operator-lock resources: - - nodes + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - get - list - - watch -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - patch -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - update -- apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - watch - apiGroups: - "" + resourceNames: + - extension-apiserver-authentication resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - get - list - - watch - - update - - delete - - create - - patch -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments/status - verbs: - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - watch - - update - - delete - apiGroups: - - storage.k8s.io - resources: - - volumeattributesclasses - verbs: - - get - - list - - watch -- apiGroups: - - '*' + - "" resources: - - events + - configmaps verbs: - get - - patch - - create - list - watch - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotclasses + - serviceaccounts verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - clusterversions - - featuregates - - apiservers - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - watch -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/azure-disk/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/azure-disk/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml index 576e5d390..84319d768 100644 --- a/assets/csidriveroperators/azure-disk/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/azure-disk/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml @@ -4,331 +4,81 @@ metadata: name: azure-disk-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers/status + - clusterversions + - featuregates verbs: - get - list - watch - - update - - patch - apiGroups: - - "" - resourceNames: - - extension-apiserver-authentication - - azure-disk-csi-driver-operator-lock + - discovery.k8s.io resources: - - configmaps + - endpointslices verbs: - get - list - watch - - create - - update - - patch - - delete - apiGroups: - - "" - resources: - - configmaps - verbs: - - watch - - list - - get -- apiGroups: - - rbac.authorization.k8s.io + - storage.k8s.io resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings + - volumeattachments/status verbs: - - watch - - list - - get - - create - - delete - patch - - update - apiGroups: - - "" + - storage.k8s.io resources: - - serviceaccounts + - volumeattributesclasses verbs: - get - list - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete - apiGroups: - "" + resourceNames: + - azure-disk-csi-driver-operator-lock resources: - - nodes + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - get - list - - watch -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - patch -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - update -- apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - watch - apiGroups: - "" + resourceNames: + - extension-apiserver-authentication resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - get - list - - watch - - update - - delete - - create - - patch -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments/status - verbs: - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - watch - - update - - delete - apiGroups: - - storage.k8s.io - resources: - - volumeattributesclasses - verbs: - - get - - list - - watch -- apiGroups: - - '*' + - "" resources: - - events + - configmaps verbs: - get - - patch - - create - list - watch - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotclasses + - serviceaccounts verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - clusterversions - - featuregates - - apiservers - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - watch -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/azure-file/base/06_clusterrole.yaml b/assets/csidriveroperators/azure-file/base/06_clusterrole.yaml index 6f53e6ed1..ef6ade962 100644 --- a/assets/csidriveroperators/azure-file/base/06_clusterrole.yaml +++ b/assets/csidriveroperators/azure-file/base/06_clusterrole.yaml @@ -6,331 +6,82 @@ metadata: storage.openshift.io/remove-from: mgmt rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers + - clusterversions + - featuregates verbs: - get - list - watch - # The Config Observer controller updates the CR's spec - - update - - patch - apiGroups: - - operator.openshift.io + - discovery.k8s.io resources: - - clustercsidrivers/status + - endpointslices verbs: - get - list - watch - - update - - patch - apiGroups: - - '' - resourceNames: - - extension-apiserver-authentication - - azure-file-csi-driver-operator-lock + - storage.k8s.io resources: - - configmaps + - volumeattachments/status verbs: - - get - - list - - watch - - create - - update - patch - - delete - apiGroups: - - '' + - "" + resourceNames: + - azure-file-csi-driver-operator-lock resources: - configmaps verbs: - - watch - - list - - get -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - create - delete - - patch - - update -- apiGroups: - - '' - resources: - - serviceaccounts - verbs: - get - list - - watch - - create - - update - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete -- apiGroups: - - '' - resources: - - nodes - verbs: - - get - - list - - watch - - create - update - - patch - - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - watch - - create - - update - - patch - - delete -- apiGroups: - - '' - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update - apiGroups: - - '' + - "" + resourceNames: + - extension-apiserver-authentication resources: - - persistentvolumes + - configmaps verbs: - create - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - get - list - - watch - - update -- apiGroups: - - '' - resources: - - pods - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - patch - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - watch - - create - - update - - patch - - delete - apiGroups: - - storage.k8s.io + - "" resources: - - volumeattachments + - configmaps verbs: - get - list - watch - - update - - delete - - create - - patch - apiGroups: - - storage.k8s.io + - "" resources: - - volumeattachments/status - verbs: - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes + - secrets verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - '*' - resources: - - events - verbs: - - get - patch - - create - - list - - watch - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotclasses - verbs: - - get - - list - - watch - - create - - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents + - serviceaccounts verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - clusterversions - - featuregates - - apiservers - verbs: - - get - - list - - watch -# Allow Prometheus to discover endpoints via EndpointSlices -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/azure-file/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/azure-file/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml index ac7b49597..440f0c0c5 100644 --- a/assets/csidriveroperators/azure-file/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/azure-file/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml @@ -4,154 +4,60 @@ metadata: name: azure-file-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers + - clusterversions + - featuregates verbs: - get - list - watch - - update - - patch - apiGroups: - - operator.openshift.io + - discovery.k8s.io resources: - - clustercsidrivers/status + - endpointslices verbs: - get - list - watch - - update - - patch - apiGroups: - - "" - resourceNames: - - extension-apiserver-authentication - - azure-file-csi-driver-operator-lock + - storage.k8s.io resources: - - configmaps + - volumeattachments/status verbs: - - get - - list - - watch - - create - - update - patch - - delete - apiGroups: - "" + resourceNames: + - azure-file-csi-driver-operator-lock resources: - configmaps verbs: - - watch - - list - - get -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - create - delete - - patch - - update -- apiGroups: - - "" - resources: - - serviceaccounts - verbs: - get - list - - watch - - create - - update - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch - - create - update - - patch - - delete + - watch - apiGroups: - "" + resourceNames: + - extension-apiserver-authentication resources: - - secrets + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - namespaces - verbs: - get - list - - watch - - create - patch - - delete - - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - update - - patch -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - get - - list - watch - - update - apiGroups: - "" resources: - - pods + - configmaps verbs: - get - list @@ -159,172 +65,21 @@ rules: - apiGroups: - "" resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - - get - - list - - watch - - update - - delete - - create - - patch -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments/status - verbs: - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes + - secrets verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - '*' - resources: - - events - verbs: - - get - patch - - create - - list - - watch - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotclasses + - serviceaccounts verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - clusterversions - - featuregates - - apiservers - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/azure-file/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/azure-file/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml index ac7b49597..440f0c0c5 100644 --- a/assets/csidriveroperators/azure-file/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/azure-file/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml @@ -4,154 +4,60 @@ metadata: name: azure-file-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io + - config.openshift.io resources: - - clustercsidrivers + - clusterversions + - featuregates verbs: - get - list - watch - - update - - patch - apiGroups: - - operator.openshift.io + - discovery.k8s.io resources: - - clustercsidrivers/status + - endpointslices verbs: - get - list - watch - - update - - patch - apiGroups: - - "" - resourceNames: - - extension-apiserver-authentication - - azure-file-csi-driver-operator-lock + - storage.k8s.io resources: - - configmaps + - volumeattachments/status verbs: - - get - - list - - watch - - create - - update - patch - - delete - apiGroups: - "" + resourceNames: + - azure-file-csi-driver-operator-lock resources: - configmaps verbs: - - watch - - list - - get -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - create - delete - - patch - - update -- apiGroups: - - "" - resources: - - serviceaccounts - verbs: - get - list - - watch - - create - - update - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch - - create - update - - patch - - delete + - watch - apiGroups: - "" + resourceNames: + - extension-apiserver-authentication resources: - - secrets + - configmaps verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - namespaces - verbs: - get - list - - watch - - create - patch - - delete - - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - update - - patch -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - get - - list - watch - - update - apiGroups: - "" resources: - - pods + - configmaps verbs: - get - list @@ -159,172 +65,21 @@ rules: - apiGroups: - "" resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - - get - - list - - watch - - update - - delete - - create - - patch -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments/status - verbs: - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes + - secrets verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - '*' - resources: - - events - verbs: - - get - patch - - create - - list - - watch - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotclasses + - serviceaccounts verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - clusterversions - - featuregates - - apiservers - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/common/aws-ebs-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/aws-ebs-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..4a3120688 --- /dev/null +++ b/assets/csidriveroperators/common/aws-ebs-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: aws-ebs-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: aws-ebs-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/common/azure-disk-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/azure-disk-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..b22b6d18f --- /dev/null +++ b/assets/csidriveroperators/common/azure-disk-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: azure-disk-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: azure-disk-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/common/azure-file-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/azure-file-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..32589d121 --- /dev/null +++ b/assets/csidriveroperators/common/azure-file-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: azure-file-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: azure-file-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/common/clusterrole.yaml b/assets/csidriveroperators/common/clusterrole.yaml new file mode 100644 index 000000000..5689b86f0 --- /dev/null +++ b/assets/csidriveroperators/common/clusterrole.yaml @@ -0,0 +1,227 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: csi-driver-operator-common-role +rules: +- apiGroups: + - '*' + resources: + - events + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - delete + - get + - list + - watch +- apiGroups: + - apps + resources: + - daemonsets + - deployments + - replicasets + - statefulsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - config.openshift.io + resources: + - apiservers + - infrastructures + - proxies + verbs: + - get + - list + - watch +- apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotclasses + verbs: + - get + - list + - watch +- apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents/status + verbs: + - patch + - update +- apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - operator.openshift.io + resources: + - clustercsidrivers + - clustercsidrivers/status + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - clusterroles + - rolebindings + - roles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - security.openshift.io + resourceNames: + - privileged + resources: + - securitycontextconstraints + verbs: + - use +- apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotclasses + verbs: + - create + - delete + - get + - list + - update + - watch +- apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotcontents/status + verbs: + - patch + - update +- apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotcontents + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots/status + verbs: + - patch +- apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - storage.k8s.io + resources: + - csidrivers + - csinodes + - storageclasses + verbs: + - create + - delete + - get + - list + - update + - watch +- apiGroups: + - storage.k8s.io + resources: + - volumeattachments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - namespaces + - nodes + - persistentvolumes + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - persistentvolumeclaims/status + verbs: + - patch + - update +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - update + - watch +- apiGroups: + - "" + resources: + - pods + - secrets + verbs: + - get + - list + - watch diff --git a/assets/csidriveroperators/common/gcp-pd-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/gcp-pd-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..964f95031 --- /dev/null +++ b/assets/csidriveroperators/common/gcp-pd-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: gcp-pd-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: gcp-pd-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/common/ibm-vpc-block-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/ibm-vpc-block-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..07daa25fb --- /dev/null +++ b/assets/csidriveroperators/common/ibm-vpc-block-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: ibm-vpc-block-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: ibm-vpc-block-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/common/manila-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/manila-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..9501e486e --- /dev/null +++ b/assets/csidriveroperators/common/manila-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: manila-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: manila-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/common/openstack-cinder-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/openstack-cinder-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..19806e1fd --- /dev/null +++ b/assets/csidriveroperators/common/openstack-cinder-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: openstack-cinder-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: openstack-cinder-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/common/powervs-block-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/powervs-block-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..c211cc795 --- /dev/null +++ b/assets/csidriveroperators/common/powervs-block-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: powervs-block-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: powervs-block-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/common/vmware-vsphere-csi-driver-operator-common-clusterrolebinding.yaml b/assets/csidriveroperators/common/vmware-vsphere-csi-driver-operator-common-clusterrolebinding.yaml new file mode 100644 index 000000000..e3ecf915a --- /dev/null +++ b/assets/csidriveroperators/common/vmware-vsphere-csi-driver-operator-common-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: vmware-vsphere-csi-driver-operator-common-clusterrolebinding +subjects: + - kind: ServiceAccount + name: vmware-vsphere-csi-driver-operator + namespace: openshift-cluster-csi-drivers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: csi-driver-operator-common-role diff --git a/assets/csidriveroperators/gcp-pd/base/05_clusterrole.yaml b/assets/csidriveroperators/gcp-pd/base/05_clusterrole.yaml index cdf6e1e5f..1bbe24b3b 100644 --- a/assets/csidriveroperators/gcp-pd/base/05_clusterrole.yaml +++ b/assets/csidriveroperators/gcp-pd/base/05_clusterrole.yaml @@ -6,331 +6,85 @@ metadata: storage.openshift.io/remove-from: mgmt rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - - hostnetwork-v2 - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - # The Config Observer controller updates the CR's spec - - update - - patch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - '' - resourceNames: - - extension-apiserver-authentication - - gcp-pd-csi-driver-operator-lock - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - '' - resources: - - serviceaccounts - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io + - config.openshift.io resources: - - customresourcedefinitions + - clusterversions + - featuregates verbs: - get - list - - create - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - '' - resources: - - nodes - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - '' - resources: - - persistentvolumes - verbs: - create - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - '' - resources: - - pods - verbs: - get - list - - watch -- apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - patch - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - watch - - create - - update - - patch - - delete - apiGroups: - - storage.k8s.io + - security.openshift.io + resourceNames: + - hostnetwork-v2 resources: - - volumeattachments + - securitycontextconstraints verbs: - - get - - list - - watch - - update - - delete - - create - - patch + - use - apiGroups: - storage.k8s.io resources: - volumeattachments/status verbs: - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch - apiGroups: - storage.k8s.io resources: - - storageclasses - - csinodes + - volumeattributesclasses verbs: - - create - get - list - watch - - update - - delete - apiGroups: - - '*' + - "" + resourceNames: + - extension-apiserver-authentication resources: - - events + - configmaps verbs: - - get - - patch - create - - list - - watch - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - get - list - - watch - - create + - patch - update - - delete + - watch - apiGroups: - - snapshot.storage.k8s.io + - "" + resourceNames: + - gcp-pd-csi-driver-operator-lock resources: - - volumesnapshotcontents + - configmaps verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattributesclasses - verbs: - - get - - list - - watch -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - - featuregates - - clusterversions - verbs: - - get - - list - - watch -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - "authentication.k8s.io" - resources: - - "tokenreviews" - verbs: - - "create" -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - watch - apiGroups: - - groupsnapshot.storage.k8s.io + - "" resources: - - volumegroupsnapshotcontents + - serviceaccounts verbs: + - create + - delete - get - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch + - watch diff --git a/assets/csidriveroperators/gcp-pd/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/gcp-pd/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml index a61c2fe11..025b6e533 100644 --- a/assets/csidriveroperators/gcp-pd/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/gcp-pd/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml @@ -4,328 +4,85 @@ metadata: name: gcp-pd-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - - hostnetwork-v2 - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - "" - resourceNames: - - extension-apiserver-authentication - - gcp-pd-csi-driver-operator-lock - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io + - config.openshift.io resources: - - customresourcedefinitions + - clusterversions + - featuregates verbs: - get - list - - create - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - "" - resources: - - pods - verbs: - get - list - - watch -- apiGroups: - - "" - resources: - - persistentvolumeclaims/status - verbs: - patch - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - watch - - create - - update - - patch - - delete - apiGroups: - - storage.k8s.io + - security.openshift.io + resourceNames: + - hostnetwork-v2 resources: - - volumeattachments + - securitycontextconstraints verbs: - - get - - list - - watch - - update - - delete - - create - - patch + - use - apiGroups: - storage.k8s.io resources: - volumeattachments/status verbs: - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch - apiGroups: - storage.k8s.io resources: - - storageclasses - - csinodes + - volumeattributesclasses verbs: - - create - get - list - watch - - update - - delete - apiGroups: - - '*' + - "" + resourceNames: + - extension-apiserver-authentication resources: - - events + - configmaps verbs: - - get - - patch - create - - list - - watch - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - get - list - - watch - - create + - patch - update - - delete + - watch - apiGroups: - - snapshot.storage.k8s.io + - "" + resourceNames: + - gcp-pd-csi-driver-operator-lock resources: - - volumesnapshotcontents + - configmaps verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattributesclasses - verbs: - - get - - list - watch - apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - - featuregates - - clusterversions - verbs: - - get - - list - - watch -- apiGroups: - - authentication.k8s.io + - "" resources: - - tokenreviews + - serviceaccounts verbs: - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: + - delete - get - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch + - watch diff --git a/assets/csidriveroperators/gcp-pd/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/gcp-pd/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml index 8ad824954..5d3e6a8f1 100644 --- a/assets/csidriveroperators/gcp-pd/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/gcp-pd/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml @@ -6,328 +6,85 @@ metadata: name: gcp-pd-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - - hostnetwork-v2 - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - "" - resourceNames: - - extension-apiserver-authentication - - gcp-pd-csi-driver-operator-lock - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io + - config.openshift.io resources: - - customresourcedefinitions + - clusterversions + - featuregates verbs: - get - list - - create - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - "" - resources: - - pods - verbs: - get - list - - watch -- apiGroups: - - "" - resources: - - persistentvolumeclaims/status - verbs: - patch - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - watch - - create - - update - - patch - - delete - apiGroups: - - storage.k8s.io + - security.openshift.io + resourceNames: + - hostnetwork-v2 resources: - - volumeattachments + - securitycontextconstraints verbs: - - get - - list - - watch - - update - - delete - - create - - patch + - use - apiGroups: - storage.k8s.io resources: - volumeattachments/status verbs: - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch - apiGroups: - storage.k8s.io resources: - - storageclasses - - csinodes + - volumeattributesclasses verbs: - - create - get - list - watch - - update - - delete - apiGroups: - - '*' + - "" + resourceNames: + - extension-apiserver-authentication resources: - - events + - configmaps verbs: - - get - - patch - create - - list - - watch - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - get - list - - watch - - create + - patch - update - - delete + - watch - apiGroups: - - snapshot.storage.k8s.io + - "" + resourceNames: + - gcp-pd-csi-driver-operator-lock resources: - - volumesnapshotcontents + - configmaps verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattributesclasses - verbs: - - get - - list - watch - apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - - featuregates - - clusterversions - verbs: - - get - - list - - watch -- apiGroups: - - authentication.k8s.io + - "" resources: - - tokenreviews + - serviceaccounts verbs: - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: + - delete - get - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch + - watch diff --git a/assets/csidriveroperators/ibm-vpc-block/06_clusterrole.yaml b/assets/csidriveroperators/ibm-vpc-block/06_clusterrole.yaml index 3cb3fa6bf..b84203efb 100644 --- a/assets/csidriveroperators/ibm-vpc-block/06_clusterrole.yaml +++ b/assets/csidriveroperators/ibm-vpc-block/06_clusterrole.yaml @@ -3,194 +3,26 @@ kind: ClusterRole metadata: name: ibm-vpc-block-csi-driver-operator-clusterrole rules: -- apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - # The Config Observer controller updates the CR's spec - - update - - patch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - '' - resourceNames: - - extension-apiserver-authentication - - ibm-vpc-block-csi-driver-operator-lock - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - '' - resources: - - serviceaccounts - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - '' - resources: - - nodes - verbs: - get - list - - watch - - create - - update - patch - - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - update -- apiGroups: - - '' - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - watch - - update - - patch - apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - '' - resources: - - pods - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - storage.k8s.io + - csi.storage.k8s.io resources: - - volumeattachments + - csinodeinfos verbs: - get - list - watch - - update - - delete - - create - - patch - apiGroups: - storage.k8s.io resources: @@ -198,98 +30,35 @@ rules: verbs: - patch - apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io + - "" + resourceNames: + - extension-apiserver-authentication resources: - - storageclasses - - csinodes + - configmaps verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - '*' - resources: - - events - verbs: - get - - patch - - create - list - - watch + - patch - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - - get - - list - watch - - create - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" + resourceNames: + - ibm-vpc-block-csi-driver-operator-lock resources: - - volumesnapshotcontents + - configmaps verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - - get - - list - watch - apiGroups: - - '' + - "" resources: - configmaps verbs: @@ -297,43 +66,14 @@ rules: - list - watch - apiGroups: - - csi.storage.k8s.io - resources: - - csinodeinfos - verbs: - - get - - list - - watch -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - "authentication.k8s.io" - resources: - - "tokenreviews" - verbs: - - "create" -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io + - "" resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents + - serviceaccounts verbs: + - create + - delete - get - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch + - watch diff --git a/assets/csidriveroperators/openstack-cinder/base/05_clusterrole.yaml b/assets/csidriveroperators/openstack-cinder/base/05_clusterrole.yaml index 99e1d1040..22eb8a5ed 100644 --- a/assets/csidriveroperators/openstack-cinder/base/05_clusterrole.yaml +++ b/assets/csidriveroperators/openstack-cinder/base/05_clusterrole.yaml @@ -6,302 +6,44 @@ metadata: storage.openshift.io/remove-from: mgmt rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -# The operator needs these config maps: -# - read/write openshift-cluster-csi-drivers/cloud-provider-config -# - read-only kube-system/extension-apiserver-authentication -# - read/write openstack-cinder-csi-driver-operator-lock -- apiGroups: - - '' - resources: - - configmaps - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - '' - resources: - - pods - verbs: - - watch - - list - - get -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete -- apiGroups: - - '' - resources: - - nodes - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - - watch - # For CA certificate sync - - create - - patch - - update -- apiGroups: - - '' - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - '' - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - '' + - discovery.k8s.io resources: - - persistentvolumeclaims + - endpointslices verbs: - get - list - watch - - update - apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps + - operator.openshift.io resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - clustercsidrivers + - clustercsidrivers/status verbs: - - get - - list - - watch - create - - update - - patch - - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - - get - - list - - watch - - update - delete - - create - - patch -- apiGroups: - - "storage.k8s.io" - resources: - - "volumeattachments/status" - verbs: - - "patch" -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch - apiGroups: - storage.k8s.io resources: - - storageclasses - - csinodes + - volumeattachments/status verbs: - - create - - get - - list - - watch - - update - - delete -- apiGroups: - - '*' - resources: - - events - verbs: - - get - patch - - create - - list - - watch - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotclasses + - configmaps verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - - get - - list - watch - apiGroups: - - operator.openshift.io + - "" resources: - - 'clustercsidrivers' - - 'clustercsidrivers/status' + - secrets verbs: - - get - - list - - watch - create - - update - - patch - - delete -# Allow Prometheus to discover endpoints via EndpointSlices -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - "authentication.k8s.io" - resources: - - "tokenreviews" - verbs: - - "create" -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch diff --git a/assets/csidriveroperators/openstack-cinder/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/openstack-cinder/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml index 57a4f66c3..7cc548155 100644 --- a/assets/csidriveroperators/openstack-cinder/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/openstack-cinder/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml @@ -6,148 +6,21 @@ metadata: name: openstack-cinder-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - "" - resources: - - configmaps - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - "" - resources: - - pods - verbs: - - watch - - list - - get -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - - patch - - update -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - "" + - discovery.k8s.io resources: - - persistentvolumeclaims + - endpointslices verbs: - get - list - watch - - update -- apiGroups: - - "" - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update - apiGroups: - - apps + - operator.openshift.io resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - clustercsidrivers + - clustercsidrivers/status verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - - get - - list - - watch - - update - - delete - - create - - patch - apiGroups: - storage.k8s.io resources: @@ -155,145 +28,22 @@ rules: verbs: - patch - apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - - watch - - update - - delete -- apiGroups: - - '*' - resources: - - events - verbs: - - get - - patch - - create - - list - - watch - - update - - delete -- apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotclasses + - configmaps verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - - get - - list - - watch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - - clustercsidrivers/status - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - watch - apiGroups: - - authentication.k8s.io + - "" resources: - - tokenreviews + - secrets verbs: - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch diff --git a/assets/csidriveroperators/openstack-cinder/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/openstack-cinder/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml index 57a4f66c3..7cc548155 100644 --- a/assets/csidriveroperators/openstack-cinder/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/openstack-cinder/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml @@ -6,148 +6,21 @@ metadata: name: openstack-cinder-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - "" - resources: - - configmaps - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - "" - resources: - - pods - verbs: - - watch - - list - - get -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - - patch - - update -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - "" - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - "" + - discovery.k8s.io resources: - - persistentvolumeclaims + - endpointslices verbs: - get - list - watch - - update -- apiGroups: - - "" - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update - apiGroups: - - apps + - operator.openshift.io resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - clustercsidrivers + - clustercsidrivers/status verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - - get - - list - - watch - - update - - delete - - create - - patch - apiGroups: - storage.k8s.io resources: @@ -155,145 +28,22 @@ rules: verbs: - patch - apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - - watch - - update - - delete -- apiGroups: - - '*' - resources: - - events - verbs: - - get - - patch - - create - - list - - watch - - update - - delete -- apiGroups: - - snapshot.storage.k8s.io + - "" resources: - - volumesnapshotclasses + - configmaps verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - - get - - list - - watch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - - clustercsidrivers/status - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - watch - apiGroups: - - authentication.k8s.io + - "" resources: - - tokenreviews + - secrets verbs: - create -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch diff --git a/assets/csidriveroperators/openstack-manila/base/05_clusterrole.yaml b/assets/csidriveroperators/openstack-manila/base/05_clusterrole.yaml index 07c5990b0..9afbbd629 100644 --- a/assets/csidriveroperators/openstack-manila/base/05_clusterrole.yaml +++ b/assets/csidriveroperators/openstack-manila/base/05_clusterrole.yaml @@ -5,371 +5,95 @@ metadata: annotations: storage.openshift.io/remove-from: mgmt rules: -- apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use - -# The operator needs these config maps: -# - read/write openshift-manila-csi-driver/cloud-provider-config -# - read-only kube-system/extension-apiserver-authentication -# - read/write manila-csi-driver-operator-lock -- apiGroups: - - '' - resources: - - configmaps - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - '' - resources: - - serviceaccounts - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - '' - resources: - - nodes - verbs: - get - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - - watch - # For CA certificate sync - - create - patch - update + - watch - apiGroups: - - '' + - discovery.k8s.io resources: - - namespaces + - endpointslices verbs: - get - list - watch - - create - - patch - - delete - - update - apiGroups: - - '' + - monitoring.coreos.com resources: - - persistentvolumes + - servicemonitors verbs: - create - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - get - - list - - watch - - update -- apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - patch - update - apiGroups: - - apps + - networking.k8s.io resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - networkpolicies verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - get - list - - watch - - update - - delete - - create - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - watch - - update - - delete - apiGroups: - - '*' + - operator.openshift.io resources: - - events + - clustercsidrivers + - clustercsidrivers/status verbs: - - get - - patch - create - - list - - watch - - update - delete - apiGroups: - - snapshot.storage.k8s.io + - policy resources: - - volumesnapshotclasses + - poddisruptionbudgets verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch + - watch - apiGroups: - - storage.k8s.io + - "" resources: - - csidrivers + - configmaps + - serviceaccounts + - services verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - get - list - - watch -- apiGroups: - - operator.openshift.io - resources: - - 'clustercsidrivers' - - 'clustercsidrivers/status' - verbs: - - get - - list - - watch - - create - - update - patch - - delete -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - "authentication.k8s.io" - resources: - - "tokenreviews" - verbs: - - "create" -# Allow the operator to create ServiceMonitor in the driver namespace -- apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - - create - update - - patch - - delete -# Allow the operator to create Service in the driver namespace -- apiGroups: - - '' - resources: - - services - verbs: - - get - - list - watch - - create - - update - - patch - - delete -# Grant these permissions in the driver namespace to Prometheus - apiGroups: - - '' + - "" resources: - - pods - endpoints verbs: - - 'get' - - 'list' - - 'watch' -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - get - list - watch - apiGroups: - - policy + - "" resources: - - poddisruptionbudgets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - networking.k8s.io - resources: - - networkpolicies + - secrets verbs: - - watch - - list - - get - create - - delete - - patch - - update -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch diff --git a/assets/csidriveroperators/openstack-manila/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/openstack-manila/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml index 63e4cd312..949ab83f3 100644 --- a/assets/csidriveroperators/openstack-manila/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/openstack-manila/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml @@ -5,360 +5,95 @@ metadata: storage.openshift.io/remove-from: mgmt name: manila-csi-driver-operator-clusterrole rules: -- apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - "" - resources: - - configmaps - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - get - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - patch - update + - watch - apiGroups: - - "" + - discovery.k8s.io resources: - - namespaces + - endpointslices verbs: - get - list - watch - - create - - patch - - delete - - update - apiGroups: - - "" + - monitoring.coreos.com resources: - - persistentvolumes + - servicemonitors verbs: - create - delete - - list - get - - watch - - update - - patch -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - "" - resources: - - persistentvolumeclaims/status - verbs: - patch - update - apiGroups: - - apps + - networking.k8s.io resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - networkpolicies verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - get - list - - watch - - update - - delete - - create - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - watch - - update - - delete - apiGroups: - - '*' + - operator.openshift.io resources: - - events + - clustercsidrivers + - clustercsidrivers/status verbs: - - get - - patch - create - - list - - watch - - update - delete - apiGroups: - - snapshot.storage.k8s.io + - policy resources: - - volumesnapshotclasses + - poddisruptionbudgets verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch + - watch - apiGroups: - - storage.k8s.io + - "" resources: - - csidrivers + - configmaps + - serviceaccounts + - services verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - get - list - - watch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - - clustercsidrivers/status - verbs: - - get - - list - - watch - - create - - update - patch - - delete -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - - create - update - - patch - - delete -- apiGroups: - - "" - resources: - - services - verbs: - - get - - list - watch - - create - - update - - patch - - delete - apiGroups: - "" resources: - - pods - endpoints verbs: - get - list - watch - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - policy - resources: - - poddisruptionbudgets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - networking.k8s.io + - "" resources: - - networkpolicies + - secrets verbs: - - watch - - list - - get - create - - delete - patch - update -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/openstack-manila/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml b/assets/csidriveroperators/openstack-manila/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml index 63e4cd312..949ab83f3 100644 --- a/assets/csidriveroperators/openstack-manila/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml +++ b/assets/csidriveroperators/openstack-manila/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml @@ -5,360 +5,95 @@ metadata: storage.openshift.io/remove-from: mgmt name: manila-csi-driver-operator-clusterrole rules: -- apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - "" - resources: - - configmaps - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update -- apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - "" - resources: - - nodes - verbs: - get - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - patch - update + - watch - apiGroups: - - "" + - discovery.k8s.io resources: - - namespaces + - endpointslices verbs: - get - list - watch - - create - - patch - - delete - - update - apiGroups: - - "" + - monitoring.coreos.com resources: - - persistentvolumes + - servicemonitors verbs: - create - delete - - list - get - - watch - - update - - patch -- apiGroups: - - "" - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - - update -- apiGroups: - - "" - resources: - - persistentvolumeclaims/status - verbs: - patch - update - apiGroups: - - apps + - networking.k8s.io resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - networkpolicies verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - get - list - - watch - - update - - delete - - create - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - update - - patch -- apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - verbs: - - create - - get - - list - watch - - update - - delete - apiGroups: - - '*' + - operator.openshift.io resources: - - events + - clustercsidrivers + - clustercsidrivers/status verbs: - - get - - patch - create - - list - - watch - - update - delete - apiGroups: - - snapshot.storage.k8s.io + - policy resources: - - volumesnapshotclasses + - poddisruptionbudgets verbs: - - get - - list - - watch - create - - update - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents - verbs: - - create - get - list - - watch - - update - - delete - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - - get - - list - - watch - update - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch + - watch - apiGroups: - - storage.k8s.io + - "" resources: - - csidrivers + - configmaps + - serviceaccounts + - services verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - get - list - - watch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - - clustercsidrivers/status - verbs: - - get - - list - - watch - - create - - update - patch - - delete -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - - create - update - - patch - - delete -- apiGroups: - - "" - resources: - - services - verbs: - - get - - list - watch - - create - - update - - patch - - delete - apiGroups: - "" resources: - - pods - endpoints verbs: - get - list - watch - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - policy - resources: - - poddisruptionbudgets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - networking.k8s.io + - "" resources: - - networkpolicies + - secrets verbs: - - watch - - list - - get - create - - delete - patch - update -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - - update - - patch diff --git a/assets/csidriveroperators/powervs-block/hypershift/guest/04_clusterrole.yaml b/assets/csidriveroperators/powervs-block/hypershift/guest/04_clusterrole.yaml index 15c8cb648..88eadcb2b 100644 --- a/assets/csidriveroperators/powervs-block/hypershift/guest/04_clusterrole.yaml +++ b/assets/csidriveroperators/powervs-block/hypershift/guest/04_clusterrole.yaml @@ -4,193 +4,37 @@ metadata: name: powervs-block-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - # The Config Observer controller updates the CR's spec - - update - - patch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - '' - resourceNames: - - extension-apiserver-authentication - - powervs-block-csi-driver-operator-lock - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io + - cloudcredential.openshift.io resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings + - credentialsrequests verbs: - - watch - - list - - get - create - delete - - patch - - update -- apiGroups: - - '' - resources: - - serviceaccounts - verbs: - get - list - - watch - - create - - update - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create + - update - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - '' - resources: - - nodes - verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - namespaces - verbs: - get - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - '' - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - patch -- apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - update -- apiGroups: - - '' - resources: - - pods - verbs: - - get - - list - watch - apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - storage.k8s.io + - csi.storage.k8s.io resources: - - volumeattachments + - csinodeinfos verbs: - get - list - watch - - update - - delete - - create - - patch - apiGroups: - storage.k8s.io resources: @@ -198,146 +42,42 @@ rules: verbs: - patch - apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io + - "" + resourceNames: + - extension-apiserver-authentication resources: - - storageclasses - - csinodes + - configmaps verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - '*' - resources: - - events - verbs: - get - - patch - - create - list - - watch + - patch - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - - get - - list - watch - - create - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" + resourceNames: + - powervs-block-csi-driver-operator-lock resources: - - volumesnapshotcontents + - configmaps verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete + - watch - apiGroups: - - cloudcredential.openshift.io + - "" resources: - - credentialsrequests + - serviceaccounts verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - - get - - list - - watch -- apiGroups: - - csi.storage.k8s.io - resources: - - csinodeinfos - verbs: - - get - - list - - watch -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - "authentication.k8s.io" - resources: - - "tokenreviews" - verbs: - - "create" -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - get - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch + - watch diff --git a/assets/csidriveroperators/powervs-block/standalone/04_clusterrole.yaml b/assets/csidriveroperators/powervs-block/standalone/04_clusterrole.yaml index 15c8cb648..88eadcb2b 100644 --- a/assets/csidriveroperators/powervs-block/standalone/04_clusterrole.yaml +++ b/assets/csidriveroperators/powervs-block/standalone/04_clusterrole.yaml @@ -4,193 +4,37 @@ metadata: name: powervs-block-csi-driver-operator-clusterrole rules: - apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - # The Config Observer controller updates the CR's spec - - update - - patch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - '' - resourceNames: - - extension-apiserver-authentication - - powervs-block-csi-driver-operator-lock - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io + - cloudcredential.openshift.io resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings + - credentialsrequests verbs: - - watch - - list - - get - create - delete - - patch - - update -- apiGroups: - - '' - resources: - - serviceaccounts - verbs: - get - list - - watch - - create - - update - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create + - update - watch - - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - '' - resources: - - nodes - verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - namespaces - verbs: - get - list - - watch - - create - - patch - - delete - - update -- apiGroups: - - '' - resources: - - persistentvolumes - verbs: - - create - - delete - - list - - get - - watch - - update - patch -- apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - - get - - list - - watch - update -- apiGroups: - - '' - resources: - - pods - verbs: - - get - - list - watch - apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - storage.k8s.io + - csi.storage.k8s.io resources: - - volumeattachments + - csinodeinfos verbs: - get - list - watch - - update - - delete - - create - - patch - apiGroups: - storage.k8s.io resources: @@ -198,146 +42,42 @@ rules: verbs: - patch - apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io + - "" + resourceNames: + - extension-apiserver-authentication resources: - - storageclasses - - csinodes + - configmaps verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - '*' - resources: - - events - verbs: - get - - patch - - create - list - - watch + - patch - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - - get - - list - watch - - create - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" + resourceNames: + - powervs-block-csi-driver-operator-lock resources: - - volumesnapshotcontents + - configmaps verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete + - watch - apiGroups: - - cloudcredential.openshift.io + - "" resources: - - credentialsrequests + - serviceaccounts verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - verbs: - - get - - list - - watch -- apiGroups: - - csi.storage.k8s.io - resources: - - csinodeinfos - verbs: - - get - - list - - watch -# Allow kube-rbac-proxy to create TokenReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - "authentication.k8s.io" - resources: - - "tokenreviews" - verbs: - - "create" -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - get - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch + - watch diff --git a/assets/csidriveroperators/vsphere/06_clusterrole.yaml b/assets/csidriveroperators/vsphere/06_clusterrole.yaml index f5f6cba14..38209820c 100644 --- a/assets/csidriveroperators/vsphere/06_clusterrole.yaml +++ b/assets/csidriveroperators/vsphere/06_clusterrole.yaml @@ -3,205 +3,68 @@ kind: ClusterRole metadata: name: vmware-vsphere-csi-driver-operator-clusterrole rules: -- apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers - verbs: - - get - - list - - watch - # The Config Observer controller updates the CR's spec - - update - - patch -- apiGroups: - - operator.openshift.io - resources: - - clustercsidrivers/status - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - '' - resourceNames: - - extension-apiserver-authentication - - vmware-vsphere-csi-driver-operator-lock - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - watch - - list - - get - - create - - delete - - patch - - update - apiGroups: - admissionregistration.k8s.io resources: - validatingwebhookconfigurations verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - '' - resources: - - serviceaccounts - verbs: - get - list - - watch - - create - - update - patch - - delete + - update + - watch - apiGroups: - apiextensions.k8s.io resources: - customresourcedefinitions verbs: - - list - - create - - watch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - patch - - delete -- apiGroups: - - '' - resources: - - nodes - verbs: - - get - - list - - watch - - create - update - - patch - - delete - apiGroups: - - '' + - authorization.k8s.io resources: - - secrets + - subjectaccessreviews verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - namespaces - verbs: - - get - - list - - watch - create - - patch - - delete - - update - apiGroups: - - '' + - cns.vmware.com resources: - - persistentvolumes + - cnsvolumeinfoes + - cnsvolumeoperationrequests + - cnsvspherevolumemigrations + - csinodetopologies + - triggercsifullsyncs verbs: - create - delete - - list - - get - - watch - - update - - patch -- apiGroups: - - '' - resources: - - persistentvolumeclaims - verbs: - get - list - - watch + - patch - update + - watch - apiGroups: - - '' + - config.openshift.io resources: - - pods + - clusterversions + - featuregates verbs: - get - list - watch - apiGroups: - - '' - resources: - - persistentvolumeclaims/status - verbs: - - patch - - update -- apiGroups: - - apps + - coordination.k8s.io resources: - - deployments - - daemonsets - - replicasets - - statefulsets + - leases verbs: - - get - - list - - watch - create - - update - - patch - delete -- apiGroups: - - storage.k8s.io - resources: - - volumeattachments - verbs: - get - list - - watch - - update - - delete - - create - patch + - update + - watch - apiGroups: - storage.k8s.io resources: @@ -209,176 +72,50 @@ rules: verbs: - patch - apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotcontents/status - verbs: - - update - - patch -- apiGroups: - - storage.k8s.io + - "" + resourceNames: + - extension-apiserver-authentication resources: - - storageclasses - - csinodes + - configmaps verbs: - create - - get - - list - - watch - - update - delete -- apiGroups: - - '*' - resources: - - events - verbs: - get - - patch - - create - list - - watch + - patch - update - - delete -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshotclasses - verbs: - - get - - list - watch - - create - - update - - delete - apiGroups: - - snapshot.storage.k8s.io + - "" + resourceNames: + - vmware-vsphere-csi-driver-operator-lock resources: - - volumesnapshotcontents + - configmaps verbs: - create - - get - - list - - watch - - update - delete - - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots - verbs: - get - list - - watch - - update - patch -- apiGroups: - - snapshot.storage.k8s.io - resources: - - volumesnapshots/status - verbs: - - patch -- apiGroups: - - storage.k8s.io - resources: - - csidrivers - verbs: - - create - - get - - list - - watch - update - - delete -- apiGroups: - - config.openshift.io - resources: - - infrastructures - - proxies - - apiservers - - featuregates - - clusterversions - verbs: - - get - - list - watch -# Needed by the CSI driver itself -# - Syncer uses pod listener -# - Feature states map uses configmap listener - apiGroups: - - '' + - "" resources: - configmaps - - pods verbs: - get - list - watch - apiGroups: - - apiextensions.k8s.io + - "" resources: - - customresourcedefinitions - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -# cns.vmware.com resource list comes from: -# https://raw.githubusercontent.com/kubernetes-sigs/vsphere-csi-driver/v3.3.1/manifests/vanilla/vsphere-csi-driver.yaml -- apiGroups: - - cns.vmware.com - resources: - - triggercsifullsyncs - - cnsvspherevolumemigrations - - cnsvolumeinfoes - - cnsvolumeoperationrequests - - csinodetopologies + - serviceaccounts verbs: - - get - - list - - watch - create - - update - - patch - delete -# Allow kube-rbac-proxy to create TokenReview and SubjectAccessReview to be able to authenticate Prometheus when collecting metrics -- apiGroups: - - "authentication.k8s.io" - resources: - - "tokenreviews" - verbs: - - "create" -- apiGroups: - - "authorization.k8s.io" - resources: - - "subjectaccessreviews" - verbs: - - "create" -# Allow the operator to grant volume group snapshot permissions to the csi-snapshotter sidecar -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotclasses - verbs: - - get - - list - - watch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents - verbs: - get - list - - watch - - update - patch -- apiGroups: - - groupsnapshot.storage.k8s.io - resources: - - volumegroupsnapshotcontents/status - verbs: - update - - patch + - watch diff --git a/manifests/08_0001_cluster_storage_operator_storage_role.yaml b/manifests/08_0001_cluster_storage_operator_storage_role.yaml new file mode 100644 index 000000000..d2e7fc20d --- /dev/null +++ b/manifests/08_0001_cluster_storage_operator_storage_role.yaml @@ -0,0 +1,518 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cluster-storage-operator-storage-role + annotations: + include.release.openshift.io/hypershift: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + capability.openshift.io/name: Storage +rules: + - apiGroups: + - '*' + resources: + - events + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apps + resources: + - daemonsets + - deployments + - replicasets + - statefulsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cloudcredential.openshift.io + resources: + - credentialsrequests + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cns.vmware.com + resources: + - cnsvolumeinfoes + - cnsvolumeoperationrequests + - cnsvspherevolumemigrations + - csinodetopologies + - triggercsifullsyncs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - config.openshift.io + resources: + - apiservers + - clusteroperators + - clusterversions + - featuregates + - infrastructures + - proxies + verbs: + - get + - list + - watch + - apiGroups: + - config.openshift.io + resources: + - clusteroperators/status + verbs: + - patch + - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - csi.storage.k8s.io + resources: + - csinodeinfos + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotclasses + verbs: + - get + - list + - watch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents/status + verbs: + - patch + - update + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - prometheusrules + - servicemonitors + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - operator.openshift.io + resources: + - clustercsidrivers + - clustercsidrivers/status + - storages + - storages/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - populator.storage.k8s.io + resources: + - volumepopulators + verbs: + - get + - list + - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - clusterroles + - rolebindings + - roles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - security.openshift.io + resourceNames: + - hostnetwork-v2 + resources: + - securitycontextconstraints + verbs: + - use + - apiGroups: + - security.openshift.io + resourceNames: + - privileged + resources: + - securitycontextconstraints + verbs: + - use + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotclasses + verbs: + - create + - delete + - get + - list + - update + - watch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotcontents/status + verbs: + - patch + - update + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotcontents + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots/status + verbs: + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - storage.k8s.io + resources: + - csidrivers + - csinodes + verbs: + - create + - delete + - get + - list + - update + - watch + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + - volumeattachments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments/status + verbs: + - patch + - apiGroups: + - storage.k8s.io + resources: + - volumeattributesclasses + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - configmaps + - endpoints + - events + - namespaces + - nodes + - persistentvolumeclaims + - persistentvolumes + - pods + - secrets + - serviceaccounts + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - aws-ebs-csi-driver-operator-lock + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - azure-disk-csi-driver-operator-lock + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - azure-file-csi-driver-operator-lock + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - extension-apiserver-authentication + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - gcp-pd-csi-driver-operator-lock + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - ibm-vpc-block-csi-driver-operator-lock + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - powervs-block-csi-driver-operator-lock + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - vmware-vsphere-csi-driver-operator-lock + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resourceNames: + - vsphere-problem-detector-operator-lock + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims/status + verbs: + - patch + - update diff --git a/manifests/08_0002_operator_rbac-delete.yaml b/manifests/08_0002_operator_rbac-delete.yaml new file mode 100644 index 000000000..568d55200 --- /dev/null +++ b/manifests/08_0002_operator_rbac-delete.yaml @@ -0,0 +1,22 @@ +# Deletion manifest for the old cluster-admin binding on standalone / CVO-managed +# profiles — marked for deletion to avoid the immutable roleRef conflict when +# migrating cluster-storage-operator-role to cluster-storage-operator-storage-role. +# HyperShift's equivalent is 08_0002_operator_rbac-hypershift-delete.yaml. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cluster-storage-operator-role + annotations: + release.openshift.io/delete: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + capability.openshift.io/name: Storage +subjects: + - kind: ServiceAccount + name: cluster-storage-operator + namespace: openshift-cluster-storage-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin diff --git a/manifests/08_0002_operator_rbac-hypershift-delete.yaml b/manifests/08_0002_operator_rbac-hypershift-delete.yaml new file mode 100644 index 000000000..6a2415f54 --- /dev/null +++ b/manifests/08_0002_operator_rbac-hypershift-delete.yaml @@ -0,0 +1,16 @@ +# Deletion manifest for old cluster-admin binding in HyperShift — marked for deletion to avoid immutable roleRef conflict +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cluster-storage-operator-role + annotations: + release.openshift.io/delete: "true" + include.release.openshift.io/hypershift: "true" +subjects: + - kind: ServiceAccount + name: cluster-storage-operator + namespace: openshift-cluster-storage-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin diff --git a/manifests/08_operator_rbac-hypershift.yaml b/manifests/08_operator_rbac-hypershift.yaml index 56adde955..4071752ac 100644 --- a/manifests/08_operator_rbac-hypershift.yaml +++ b/manifests/08_operator_rbac-hypershift.yaml @@ -7,8 +7,9 @@ metadata: kubernetes.io/cluster-service: "true" name: cluster-storage-operator-role roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: cluster-admin + name: cluster-storage-operator-storage-role subjects: - kind: ServiceAccount name: cluster-storage-operator diff --git a/manifests/08_operator_rbac.yaml b/manifests/08_operator_rbac.yaml index 7f83fa757..cb76a6a3c 100644 --- a/manifests/08_operator_rbac.yaml +++ b/manifests/08_operator_rbac.yaml @@ -1,3 +1,9 @@ +# Replacement binding to the fine-grained cluster-storage-operator-storage-role. +# The old cluster-admin binding is removed separately so this file stays a single +# document and its HyperShift profile variant (08_operator_rbac-hypershift.yaml) +# is generated correctly: +# - standalone / CVO-managed: 08_0002_operator_rbac-delete.yaml +# - HyperShift: 08_0002_operator_rbac-hypershift-delete.yaml kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: @@ -16,6 +22,6 @@ subjects: name: cluster-storage-operator namespace: openshift-cluster-storage-operator roleRef: - # TODO: rework to smaller roles + apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: cluster-admin + name: cluster-storage-operator-storage-role diff --git a/manifests/08_operator_scc.yaml b/manifests/08_operator_scc.yaml new file mode 100644 index 000000000..612675e9d --- /dev/null +++ b/manifests/08_operator_scc.yaml @@ -0,0 +1,20 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cluster-storage-operator-nonroot-v2-scc + labels: + kubernetes.io/cluster-service: "true" + addonmanager.kubernetes.io/mode: Reconcile + annotations: + include.release.openshift.io/hypershift: "true" + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + capability.openshift.io/name: Storage +subjects: + - kind: ServiceAccount + name: cluster-storage-operator + namespace: openshift-cluster-storage-operator +roleRef: + kind: ClusterRole + name: system:openshift:scc:nonroot-v2 diff --git a/manifests/10_deployment.yaml b/manifests/10_deployment.yaml index 7373a72ad..8fe305031 100644 --- a/manifests/10_deployment.yaml +++ b/manifests/10_deployment.yaml @@ -41,9 +41,11 @@ spec: serviceAccountName: cluster-storage-operator securityContext: runAsNonRoot: true - # Force a specific UID, just in case this Pod matches a custom SCC with "runAsUser: type: runAsNonRoot". - # The UID value was chosen by a fair `echo $RANDOM` call. - # TODO: remove cluster-admin from the operator, then a specific UID won't be needed. + # The nonroot-v2 SCC accepts any non-zero UID or a non-root image USER. + # This manifest explicitly pins UID to 11411 for consistency and predictability. + # Omitting the UID may cause admission rejection if the container image does not + # declare a non-root USER, so specifying it here ensures reliable pod scheduling + # regardless of the image's user declaration. runAsUser: 11411 seccompProfile: type: RuntimeDefault diff --git a/pkg/operator/csidriveroperator/csioperatorclient/aws.go b/pkg/operator/csidriveroperator/csioperatorclient/aws.go index 1ad9e9bfd..a2738a1c3 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/aws.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/aws.go @@ -39,6 +39,8 @@ func GetAWSEBSCSIOperatorConfig(isHypershift bool) CSIOperatorConfig { "csidriveroperators/aws-ebs/standalone/generated/rbac.authorization.k8s.io_v1_rolebinding_aws-ebs-csi-driver-operator-rolebinding.yaml", "csidriveroperators/aws-ebs/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml", "csidriveroperators/aws-ebs/standalone/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_aws-ebs-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/aws-ebs-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/aws-ebs/standalone/generated/v1_service_aws-ebs-csi-driver-operator-metrics.yaml", "csidriveroperators/aws-ebs/standalone/07_role_aws_config.yaml", "csidriveroperators/aws-ebs/standalone/08_rolebinding_aws_config.yaml", @@ -52,6 +54,8 @@ func GetAWSEBSCSIOperatorConfig(isHypershift bool) CSIOperatorConfig { "csidriveroperators/aws-ebs/hypershift/guest/generated/rbac.authorization.k8s.io_v1_rolebinding_aws-ebs-csi-driver-operator-rolebinding.yaml", "csidriveroperators/aws-ebs/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_aws-ebs-csi-driver-operator-clusterrole.yaml", "csidriveroperators/aws-ebs/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_aws-ebs-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/aws-ebs-csi-driver-operator-common-clusterrolebinding.yaml", } csiDriverConfig.MgmtOperatorConfigAsset = "csidriveroperators/aws-ebs/hypershift/mgmt/generated/v1_configmap_aws-ebs-csi-driver-operator-config.yaml" csiDriverConfig.MgmtStaticAssets = []string{ diff --git a/pkg/operator/csidriveroperator/csioperatorclient/azure-disk.go b/pkg/operator/csidriveroperator/csioperatorclient/azure-disk.go index e6833f7b6..f2059a226 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/azure-disk.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/azure-disk.go @@ -40,6 +40,8 @@ func GetAzureDiskCSIOperatorConfig(isHyperShift bool) CSIOperatorConfig { "csidriveroperators/azure-disk/standalone/generated/rbac.authorization.k8s.io_v1_role_azure-disk-csi-driver-operator-role.yaml", "csidriveroperators/azure-disk/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml", "csidriveroperators/azure-disk/standalone/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_azure-disk-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/azure-disk-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/azure-disk/standalone/generated/rbac.authorization.k8s.io_v1_rolebinding_azure-disk-csi-driver-operator-rolebinding.yaml", "csidriveroperators/azure-disk/standalone/generated/v1_service_azure-disk-csi-driver-operator-metrics.yaml", } @@ -49,6 +51,8 @@ func GetAzureDiskCSIOperatorConfig(isHyperShift bool) CSIOperatorConfig { csiDriverConfig.StaticAssets = []string{ "csidriveroperators/azure-disk/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-disk-csi-driver-operator-clusterrole.yaml", "csidriveroperators/azure-disk/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_azure-disk-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/azure-disk-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/azure-disk/hypershift/guest/generated/rbac.authorization.k8s.io_v1_role_azure-disk-csi-driver-operator-role.yaml", "csidriveroperators/azure-disk/hypershift/guest/generated/rbac.authorization.k8s.io_v1_rolebinding_azure-disk-csi-driver-operator-rolebinding.yaml", "csidriveroperators/azure-disk/hypershift/guest/generated/v1_serviceaccount_azure-disk-csi-driver-operator.yaml", diff --git a/pkg/operator/csidriveroperator/csioperatorclient/azure-file.go b/pkg/operator/csidriveroperator/csioperatorclient/azure-file.go index 7c287cd5b..d7657f2f9 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/azure-file.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/azure-file.go @@ -53,6 +53,8 @@ func GetAzureFileCSIOperatorConfig(isHyperShift bool) CSIOperatorConfig { "csidriveroperators/azure-file/standalone/generated/rbac.authorization.k8s.io_v1_rolebinding_azure-file-csi-driver-operator-rolebinding.yaml", "csidriveroperators/azure-file/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml", "csidriveroperators/azure-file/standalone/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_azure-file-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/azure-file-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/azure-file/standalone/generated/v1_service_azure-file-csi-driver-operator-metrics.yaml", } csiDriverConfig.DeploymentAsset = "csidriveroperators/azure-file/standalone/generated/apps_v1_deployment_azure-file-csi-driver-operator.yaml" @@ -61,6 +63,8 @@ func GetAzureFileCSIOperatorConfig(isHyperShift bool) CSIOperatorConfig { csiDriverConfig.StaticAssets = []string{ "csidriveroperators/azure-file/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_azure-file-csi-driver-operator-clusterrole.yaml", "csidriveroperators/azure-file/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_azure-file-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/azure-file-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/azure-file/hypershift/guest/generated/rbac.authorization.k8s.io_v1_role_azure-file-csi-driver-operator-role.yaml", "csidriveroperators/azure-file/hypershift/guest/generated/rbac.authorization.k8s.io_v1_rolebinding_azure-file-csi-driver-operator-rolebinding.yaml", "csidriveroperators/azure-file/hypershift/guest/generated/v1_serviceaccount_azure-file-csi-driver-operator.yaml", diff --git a/pkg/operator/csidriveroperator/csioperatorclient/cinder.go b/pkg/operator/csidriveroperator/csioperatorclient/cinder.go index ff75fcfc9..b34c06f76 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/cinder.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/cinder.go @@ -39,6 +39,8 @@ func GetOpenStackCinderCSIOperatorConfig(isHypershift bool) CSIOperatorConfig { "csidriveroperators/openstack-cinder/standalone/generated/rbac.authorization.k8s.io_v1_rolebinding_openstack-cinder-csi-driver-operator-rolebinding.yaml", "csidriveroperators/openstack-cinder/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml", "csidriveroperators/openstack-cinder/standalone/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_openstack-cinder-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/openstack-cinder-csi-driver-operator-common-clusterrolebinding.yaml", } csiDriverConfig.CRAsset = "csidriveroperators/openstack-cinder/standalone/generated/operator.openshift.io_v1_clustercsidriver_cinder.csi.openstack.org.yaml" csiDriverConfig.DeploymentAsset = "csidriveroperators/openstack-cinder/standalone/generated/apps_v1_deployment_openstack-cinder-csi-driver-operator.yaml" @@ -46,6 +48,8 @@ func GetOpenStackCinderCSIOperatorConfig(isHypershift bool) CSIOperatorConfig { csiDriverConfig.StaticAssets = []string{ "csidriveroperators/openstack-cinder/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_openstack-cinder-csi-driver-operator-clusterrole.yaml", "csidriveroperators/openstack-cinder/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_openstack-cinder-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/openstack-cinder-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/openstack-cinder/hypershift/guest/generated/rbac.authorization.k8s.io_v1_role_openstack-cinder-csi-driver-operator-role.yaml", "csidriveroperators/openstack-cinder/hypershift/guest/generated/rbac.authorization.k8s.io_v1_rolebinding_openstack-cinder-csi-driver-operator-rolebinding.yaml", "csidriveroperators/openstack-cinder/hypershift/guest/generated/v1_serviceaccount_openstack-cinder-csi-driver-operator.yaml", diff --git a/pkg/operator/csidriveroperator/csioperatorclient/gcp-pd.go b/pkg/operator/csidriveroperator/csioperatorclient/gcp-pd.go index 0cf2235de..8c901a078 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/gcp-pd.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/gcp-pd.go @@ -39,6 +39,8 @@ func GetGCPPDCSIOperatorConfig(isHypershift bool) CSIOperatorConfig { "csidriveroperators/gcp-pd/standalone/generated/rbac.authorization.k8s.io_v1_rolebinding_gcp-pd-csi-driver-operator-rolebinding.yaml", "csidriveroperators/gcp-pd/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml", "csidriveroperators/gcp-pd/standalone/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_gcp-pd-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/gcp-pd-csi-driver-operator-common-clusterrolebinding.yaml", } csiDriverConfig.CRAsset = "csidriveroperators/gcp-pd/standalone/generated/operator.openshift.io_v1_clustercsidriver_pd.csi.storage.gke.io.yaml" csiDriverConfig.DeploymentAsset = "csidriveroperators/gcp-pd/standalone/generated/apps_v1_deployment_gcp-pd-csi-driver-operator.yaml" @@ -46,6 +48,8 @@ func GetGCPPDCSIOperatorConfig(isHypershift bool) CSIOperatorConfig { csiDriverConfig.StaticAssets = []string{ "csidriveroperators/gcp-pd/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_gcp-pd-csi-driver-operator-clusterrole.yaml", "csidriveroperators/gcp-pd/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_gcp-pd-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/gcp-pd-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/gcp-pd/hypershift/guest/generated/rbac.authorization.k8s.io_v1_role_gcp-pd-csi-driver-operator-role.yaml", "csidriveroperators/gcp-pd/hypershift/guest/generated/rbac.authorization.k8s.io_v1_rolebinding_gcp-pd-csi-driver-operator-rolebinding.yaml", "csidriveroperators/gcp-pd/hypershift/guest/generated/v1_serviceaccount_gcp-pd-csi-driver-operator.yaml", diff --git a/pkg/operator/csidriveroperator/csioperatorclient/ibm-vpc-block.go b/pkg/operator/csidriveroperator/csioperatorclient/ibm-vpc-block.go index 5c1bed5d8..ebabf93cb 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/ibm-vpc-block.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/ibm-vpc-block.go @@ -47,6 +47,8 @@ func GetIBMVPCBlockCSIOperatorConfig() CSIOperatorConfig { "csidriveroperators/ibm-vpc-block/05_rolebinding.yaml", "csidriveroperators/ibm-vpc-block/06_clusterrole.yaml", "csidriveroperators/ibm-vpc-block/07_clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/ibm-vpc-block-csi-driver-operator-common-clusterrolebinding.yaml", }, CRAsset: "csidriveroperators/ibm-vpc-block/09_cr.yaml", DeploymentAsset: "csidriveroperators/ibm-vpc-block/08_deployment.yaml", diff --git a/pkg/operator/csidriveroperator/csioperatorclient/manila.go b/pkg/operator/csidriveroperator/csioperatorclient/manila.go index b5496ea98..96ab38c95 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/manila.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/manila.go @@ -52,6 +52,8 @@ func GetOpenStackManilaOperatorConfig(isHypershift bool, clients *csoclients.Cli "csidriveroperators/openstack-manila/standalone/generated/openshift-cluster-csi-drivers_rbac.authorization.k8s.io_v1_rolebinding_manila-csi-driver-operator-rolebinding.yaml", "csidriveroperators/openstack-manila/standalone/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml", "csidriveroperators/openstack-manila/standalone/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_manila-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/manila-csi-driver-operator-common-clusterrolebinding.yaml", } csiDriverConfig.CRAsset = "csidriveroperators/openstack-manila/standalone/generated/default_operator.openshift.io_v1_clustercsidriver_manila.csi.openstack.org.yaml" csiDriverConfig.DeploymentAsset = "csidriveroperators/openstack-manila/standalone/generated/openshift-cluster-csi-drivers_apps_v1_deployment_manila-csi-driver-operator.yaml" @@ -60,6 +62,8 @@ func GetOpenStackManilaOperatorConfig(isHypershift bool, clients *csoclients.Cli "csidriveroperators/openstack-manila/hypershift/guest/generated/v1_namespace_openshift-manila-csi-driver.yaml", "csidriveroperators/openstack-manila/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrole_manila-csi-driver-operator-clusterrole.yaml", "csidriveroperators/openstack-manila/hypershift/guest/generated/rbac.authorization.k8s.io_v1_clusterrolebinding_manila-csi-driver-operator-clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/manila-csi-driver-operator-common-clusterrolebinding.yaml", } csiDriverConfig.MgmtOperatorConfigAsset = "csidriveroperators/openstack-manila/hypershift/mgmt/generated/v1_configmap_manila-csi-driver-operator-config.yaml" csiDriverConfig.MgmtStaticAssets = []string{ diff --git a/pkg/operator/csidriveroperator/csioperatorclient/powervs-block.go b/pkg/operator/csidriveroperator/csioperatorclient/powervs-block.go index a38a0705a..8d5c3de38 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/powervs-block.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/powervs-block.go @@ -36,6 +36,8 @@ func GetPowerVSBlockCSIOperatorConfig(isHypershift bool) CSIOperatorConfig { "csidriveroperators/powervs-block/standalone/03_rolebinding.yaml", "csidriveroperators/powervs-block/standalone/04_clusterrole.yaml", "csidriveroperators/powervs-block/standalone/05_clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/powervs-block-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/powervs-block/standalone/08_service.yaml", } csiDriverConfig.CRAsset = "csidriveroperators/powervs-block/standalone/07_cr.yaml" @@ -47,6 +49,8 @@ func GetPowerVSBlockCSIOperatorConfig(isHypershift bool) CSIOperatorConfig { "csidriveroperators/powervs-block/hypershift/guest/03_rolebinding.yaml", "csidriveroperators/powervs-block/hypershift/guest/04_clusterrole.yaml", "csidriveroperators/powervs-block/hypershift/guest/05_clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/powervs-block-csi-driver-operator-common-clusterrolebinding.yaml", } csiDriverConfig.MgmtOperatorConfigAsset = "csidriveroperators/powervs-block/hypershift/mgmt/03_configmap.yaml" csiDriverConfig.MgmtStaticAssets = []string{ diff --git a/pkg/operator/csidriveroperator/csioperatorclient/vsphere.go b/pkg/operator/csidriveroperator/csioperatorclient/vsphere.go index b93066569..dccba3910 100644 --- a/pkg/operator/csidriveroperator/csioperatorclient/vsphere.go +++ b/pkg/operator/csidriveroperator/csioperatorclient/vsphere.go @@ -33,6 +33,8 @@ func GetVMwareVSphereCSIOperatorConfig() CSIOperatorConfig { "csidriveroperators/vsphere/05_rolebinding.yaml", "csidriveroperators/vsphere/06_clusterrole.yaml", "csidriveroperators/vsphere/07_clusterrolebinding.yaml", + "csidriveroperators/common/clusterrole.yaml", + "csidriveroperators/common/vmware-vsphere-csi-driver-operator-common-clusterrolebinding.yaml", "csidriveroperators/vsphere/11_service.yaml", "csidriveroperators/vsphere/13_prometheus_role.yaml", "csidriveroperators/vsphere/14_prometheus_rolebinding.yaml",