From cb1899b8c0be1dadd804d8d2235a766e3e6ad01f Mon Sep 17 00:00:00 2001 From: Niels de Vos Date: Thu, 10 Dec 2020 11:27:11 +0100 Subject: [PATCH] deploy: allow rbd nodeplugin to read Secrets from Tenants In order to fetch the Kubernetes Secret with the Vault Token for a Tenant, the ClusterRole needs to allow reading Secrets from all Kubernetes Namespaces (each Tenant has their own Namespace). Signed-off-by: Niels de Vos --- charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml | 5 ++++- deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml b/charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml index 4a34515f1..2a642ed29 100644 --- a/charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml +++ b/charts/ceph-csi-rbd/templates/nodeplugin-clusterrole.yaml @@ -1,5 +1,4 @@ {{- if .Values.rbac.create -}} -{{- if .Values.topology.enabled }} kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: @@ -11,8 +10,12 @@ metadata: release: {{ .Release.Name }} heritage: {{ .Release.Service }} rules: +{{- if .Values.topology.enabled }} - apiGroups: [""] resources: ["nodes"] verbs: ["get"] {{- end }} + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] {{- end -}} diff --git a/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml b/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml index db1245cd9..fa9bb61ab 100644 --- a/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml +++ b/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml @@ -12,6 +12,9 @@ rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1