Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PWX-32732 : use portworx-restricted based on IsPrivileged flag #1191

Merged
merged 5 commits into from
Aug 9, 2023
Merged

PWX-32732 : use portworx-restricted based on IsPrivileged flag #1191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
df61352
use portworx-restricted based on IsPrivileged flag
nikita-bhatia Aug 8, 2023
b58de45
Add UTs for install with non-privileged annotation
nikita-bhatia Aug 9, 2023
a2b88b1
Add UTs for install with non-privileged annotation
nikita-bhatia Aug 9, 2023
0cd4085
remove debug logs
nikita-bhatia Aug 9, 2023
56dfb2e
Merge remote-tracking branch 'origin/px-rel-23.7.0' into PWX-32732
nikita-bhatia Aug 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion drivers/storage/portworx/component/csi.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,11 @@ func (c *csi) createClusterRole(
cluster *corev1.StorageCluster,
csiConfig *pxutil.CSIConfiguration,
) error {
sccName := PxSCCName
if !pxutil.IsPrivileged(cluster) {
sccName = PxRestrictedSCCName
}

clusterRole := &rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{
Name: CSIClusterRoleName,
Expand Down Expand Up @@ -320,7 +325,7 @@ func (c *csi) createClusterRole(
{
APIGroups: []string{"security.openshift.io"},
Resources: []string{"securitycontextconstraints"},
ResourceNames: []string{PxRestrictedSCCName},
ResourceNames: []string{sccName},
Verbs: []string{"use"},
},
{
Expand Down
136 changes: 70 additions & 66 deletions drivers/storage/portworx/component/lighthouse.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ func (c *lighthouse) Reconcile(cluster *corev1.StorageCluster) error {
if err := c.createServiceAccount(cluster.Namespace, ownerRef); err != nil {
return err
}
if err := c.createClusterRole(); err != nil {
if err := c.createClusterRole(cluster); err != nil {
return err
}
if err := c.createClusterRoleBinding(cluster.Namespace); err != nil {
Expand Down Expand Up @@ -147,75 +147,79 @@ func (c *lighthouse) createServiceAccount(
)
}

func (c *lighthouse) createClusterRole() error {
return k8sutil.CreateOrUpdateClusterRole(
c.k8sClient,
&rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{
Name: LhClusterRoleName,
func (c *lighthouse) createClusterRole(cluster *corev1.StorageCluster) error {
sccName := PxSCCName
if !pxutil.IsPrivileged(cluster) {
sccName = PxRestrictedSCCName
}

clusterRole := &rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{
Name: LhClusterRoleName,
},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{""},
Resources: []string{"pods"},
Verbs: []string{"get", "list"},
},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{""},
Resources: []string{"pods"},
Verbs: []string{"get", "list"},
},
{
APIGroups: []string{"extensions", "apps"},
Resources: []string{"deployments"},
Verbs: []string{"get", "list"},
},
{
APIGroups: []string{""},
Resources: []string{"secrets"},
Verbs: []string{"get", "create", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"configmaps"},
Verbs: []string{"get", "create", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"nodes"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{""},
Resources: []string{"services"},
Verbs: []string{"get", "list", "watch", "create"},
},
{
APIGroups: []string{"stork.libopenstorage.org"},
Resources: []string{"*"},
Verbs: []string{"get", "list", "create", "delete", "update"},
},
{
APIGroups: []string{"monitoring.coreos.com"},
Resources: []string{
"alertmanagers",
"prometheuses",
"prometheuses/finalizers",
"servicemonitors",
"prometheusrules",
},
Verbs: []string{"*"},
},
{
APIGroups: []string{"security.openshift.io"},
Resources: []string{"securitycontextconstraints"},
ResourceNames: []string{PxRestrictedSCCName, "anyuid"},
Verbs: []string{"use"},
},
{
APIGroups: []string{"policy"},
Resources: []string{"podsecuritypolicies"},
ResourceNames: []string{constants.PrivilegedPSPName},
Verbs: []string{"use"},
{
APIGroups: []string{"extensions", "apps"},
Resources: []string{"deployments"},
Verbs: []string{"get", "list"},
},
{
APIGroups: []string{""},
Resources: []string{"secrets"},
Verbs: []string{"get", "create", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"configmaps"},
Verbs: []string{"get", "create", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"nodes"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{""},
Resources: []string{"services"},
Verbs: []string{"get", "list", "watch", "create"},
},
{
APIGroups: []string{"stork.libopenstorage.org"},
Resources: []string{"*"},
Verbs: []string{"get", "list", "create", "delete", "update"},
},
{
APIGroups: []string{"monitoring.coreos.com"},
Resources: []string{
"alertmanagers",
"prometheuses",
"prometheuses/finalizers",
"servicemonitors",
"prometheusrules",
},
Verbs: []string{"*"},
},
{
APIGroups: []string{"security.openshift.io"},
Resources: []string{"securitycontextconstraints"},
ResourceNames: []string{sccName, "anyuid"},
Verbs: []string{"use"},
},
{
APIGroups: []string{"policy"},
Resources: []string{"podsecuritypolicies"},
ResourceNames: []string{constants.PrivilegedPSPName},
Verbs: []string{"use"},
},
},
)
}

return k8sutil.CreateOrUpdateClusterRole(c.k8sClient, clusterRole)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems to be a new addition... was this a mistake, or was this line required ?

Copy link
Contributor Author

@nikita-bhatia nikita-bhatia Aug 9, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This method was returning k8sutil.CreateOrUpdateClusterRole , moved it to last line to add conditional statement of SCC name before creating the cluster role.

}

func (c *lighthouse) createClusterRoleBinding(
Expand Down
186 changes: 95 additions & 91 deletions drivers/storage/portworx/component/pvccontroller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ func (c *pvcController) Reconcile(cluster *corev1.StorageCluster) error {
if err := c.createServiceAccount(cluster.Namespace, ownerRef); err != nil {
return err
}
if err := c.createClusterRole(); err != nil {
if err := c.createClusterRole(cluster); err != nil {
return err
}
if err := c.createClusterRoleBinding(cluster.Namespace); err != nil {
Expand Down Expand Up @@ -162,99 +162,103 @@ func (c *pvcController) createServiceAccount(
)
}

func (c *pvcController) createClusterRole() error {
return k8sutil.CreateOrUpdateClusterRole(
c.k8sClient,
&rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{
Name: PVCClusterRoleName,
func (c *pvcController) createClusterRole(cluster *corev1.StorageCluster) error {
sccName := PxSCCName
if !pxutil.IsPrivileged(cluster) {
sccName = PxRestrictedSCCName
}

clusterRole := &rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{
Name: PVCClusterRoleName,
},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{""},
Resources: []string{"persistentvolumes"},
Verbs: []string{"get", "list", "watch", "create", "delete", "update"},
},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{""},
Resources: []string{"persistentvolumes"},
Verbs: []string{"get", "list", "watch", "create", "delete", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"persistentvolumes/status"},
Verbs: []string{"update"},
},
{
APIGroups: []string{""},
Resources: []string{"persistentvolumeclaims"},
Verbs: []string{"get", "list", "watch", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"persistentvolumeclaims/status"},
Verbs: []string{"update"},
},
{
APIGroups: []string{""},
Resources: []string{"pods"},
Verbs: []string{"get", "list", "watch", "create", "delete"},
},
{
APIGroups: []string{"storage.k8s.io"},
Resources: []string{"storageclasses"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{""},
Resources: []string{"endpoints", "services"},
Verbs: []string{"get", "create", "delete", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"secrets"},
Verbs: []string{"get", "list"},
},
{
APIGroups: []string{""},
Resources: []string{"nodes"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{""},
Resources: []string{"events"},
Verbs: []string{"watch", "create", "update", "patch"},
},
{
APIGroups: []string{""},
Resources: []string{"serviceaccounts"},
Verbs: []string{"get", "create"},
},
{
APIGroups: []string{""},
Resources: []string{"serviceaccounts/token"},
Verbs: []string{"create"},
},
{
APIGroups: []string{""},
Resources: []string{"configmaps"},
Verbs: []string{"get", "list", "watch", "create", "update"},
},
{
APIGroups: []string{"security.openshift.io"},
Resources: []string{"securitycontextconstraints"},
ResourceNames: []string{PxRestrictedSCCName},
Verbs: []string{"use"},
},
{
APIGroups: []string{"policy"},
Resources: []string{"podsecuritypolicies"},
ResourceNames: []string{constants.PrivilegedPSPName},
Verbs: []string{"use"},
},
{
APIGroups: []string{"coordination.k8s.io"},
Resources: []string{"leases"},
Verbs: []string{"*"},
},
{
APIGroups: []string{""},
Resources: []string{"persistentvolumes/status"},
Verbs: []string{"update"},
},
{
APIGroups: []string{""},
Resources: []string{"persistentvolumeclaims"},
Verbs: []string{"get", "list", "watch", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"persistentvolumeclaims/status"},
Verbs: []string{"update"},
},
{
APIGroups: []string{""},
Resources: []string{"pods"},
Verbs: []string{"get", "list", "watch", "create", "delete"},
},
{
APIGroups: []string{"storage.k8s.io"},
Resources: []string{"storageclasses"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{""},
Resources: []string{"endpoints", "services"},
Verbs: []string{"get", "create", "delete", "update"},
},
{
APIGroups: []string{""},
Resources: []string{"secrets"},
Verbs: []string{"get", "list"},
},
{
APIGroups: []string{""},
Resources: []string{"nodes"},
Verbs: []string{"get", "list", "watch"},
},
{
APIGroups: []string{""},
Resources: []string{"events"},
Verbs: []string{"watch", "create", "update", "patch"},
},
{
APIGroups: []string{""},
Resources: []string{"serviceaccounts"},
Verbs: []string{"get", "create"},
},
{
APIGroups: []string{""},
Resources: []string{"serviceaccounts/token"},
Verbs: []string{"create"},
},
{
APIGroups: []string{""},
Resources: []string{"configmaps"},
Verbs: []string{"get", "list", "watch", "create", "update"},
},
{
APIGroups: []string{"security.openshift.io"},
Resources: []string{"securitycontextconstraints"},
ResourceNames: []string{sccName},
Verbs: []string{"use"},
},
{
APIGroups: []string{"policy"},
Resources: []string{"podsecuritypolicies"},
ResourceNames: []string{constants.PrivilegedPSPName},
Verbs: []string{"use"},
},
{
APIGroups: []string{"coordination.k8s.io"},
Resources: []string{"leases"},
Verbs: []string{"*"},
},
},
)
}

return k8sutil.CreateOrUpdateClusterRole(c.k8sClient, clusterRole)
}

func (c *pvcController) createClusterRoleBinding(
Expand Down
Loading
Loading