From 8662e01d2c13a3018b389f4710f685a20b0fb4f6 Mon Sep 17 00:00:00 2001 From: Niels de Vos Date: Thu, 24 Jun 2021 12:39:40 +0200 Subject: [PATCH] deploy: allow RBD components to get ServiceAccounts The provisioner and node-plugin have the capability to connect to Hashicorp Vault with a ServiceAccount from the Namespace where the PVC is created. This requires permissions to read the contents of the ServiceAccount from an other Namespace than where Ceph-CSI is deployed. Signed-off-by: Niels de Vos --- charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml | 3 +++ charts/ceph-csi-rbd/templates/provisioner-clusterrole.yaml | 3 +++ deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml | 3 +++ deploy/rbd/kubernetes/csi-provisioner-rbac.yaml | 3 +++ 4 files changed, 12 insertions(+) diff --git a/charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml b/charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml index fa0542c13..bd24085cb 100644 --- a/charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml +++ b/charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml @@ -22,4 +22,7 @@ rules: - apiGroups: [""] resources: ["configmaps"] verbs: ["get"] + - apiGroups: [""] + resources: ["serviceaccounts"] + verbs: ["get"] {{- end -}} diff --git a/charts/ceph-csi-rbd/templates/provisioner-clusterrole.yaml b/charts/ceph-csi-rbd/templates/provisioner-clusterrole.yaml index 1f7aca806..c620183a7 100644 --- a/charts/ceph-csi-rbd/templates/provisioner-clusterrole.yaml +++ b/charts/ceph-csi-rbd/templates/provisioner-clusterrole.yaml @@ -51,6 +51,9 @@ rules: - apiGroups: [""] resources: ["configmaps"] verbs: ["get"] + - apiGroups: [""] + resources: ["serviceaccounts"] + verbs: ["get"] {{- if .Values.provisioner.resizer.enabled }} - apiGroups: [""] resources: ["persistentvolumeclaims/status"] diff --git a/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml b/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml index 5d02593ec..b479eff2f 100644 --- a/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml +++ b/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml @@ -19,6 +19,9 @@ rules: - apiGroups: [""] resources: ["configmaps"] verbs: ["get"] + - apiGroups: [""] + resources: ["serviceaccounts"] + verbs: ["get"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 diff --git a/deploy/rbd/kubernetes/csi-provisioner-rbac.yaml b/deploy/rbd/kubernetes/csi-provisioner-rbac.yaml index 585cfbe2f..e315cdcd3 100644 --- a/deploy/rbd/kubernetes/csi-provisioner-rbac.yaml +++ b/deploy/rbd/kubernetes/csi-provisioner-rbac.yaml @@ -55,6 +55,9 @@ rules: - apiGroups: [""] resources: ["configmaps"] verbs: ["get"] + - apiGroups: [""] + resources: ["serviceaccounts"] + verbs: ["get"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1