STOR-1065: Rework sidecar bindings to bind common ClusterRoles

PR openshift/cluster-storage-operator#379 published builiding blocks of sidecar ClusterRoles. Now, ibm-vpc-block csi driver operator may compose its sidecars ClusterRoles from those building blocks.

This PR also moves permissions for `leases` resource from ClusterRole to per-namespace Role (`assets/rbac/lease_leader_election_role.yaml`).

assets/rbac/configmap_and_secret_reader_provisioner_binding.yaml

@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ibm-vpc-block-csi-configmap-and-secret-reader-provisioner-binding
+subjects:
+  - kind: ServiceAccount
+    name: ibm-vpc-block-controller-sa
+    namespace: openshift-cluster-csi-drivers
+roleRef:
+  kind: ClusterRole
+  name: openshift-csi-provisioner-configmap-and-secret-reader-role
+  apiGroup: rbac.authorization.k8s.io

assets/rbac/lease_leader_election_role.yaml

@@ -0,0 +1,10 @@
+# Role for electing leader by the operator
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ibm-vpc-block-csi-driver-lease-leader-election
+  namespace: openshift-cluster-csi-drivers
+rules:
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "watch", "list", "delete", "update", "create"]

assets/rbac/lease_leader_election_rolebinding.yaml

@@ -0,0 +1,14 @@
+# Grant controller access to leases
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ibm-vpc-block-csi-driver-lease-leader-election
+  namespace: openshift-cluster-csi-drivers
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ibm-vpc-block-csi-driver-lease-leader-election
+subjects:
+- kind: ServiceAccount
+  name: ibm-vpc-block-controller-sa
+  namespace: openshift-cluster-csi-drivers

assets/rbac/provisioner_binding.yaml → assets/rbac/main_attacher_binding.yaml

@@ -4,11 +4,11 @@ metadata:
   labels:
     addonmanager.kubernetes.io/mode: Reconcile
     app: ibm-vpc-block-csi-driver
-  name: vpc-block-provisioner-binding
+  name: vpc-block-main-attacher-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: vpc-block-provisioner-role
+  name: openshift-csi-main-attacher-role
 subjects:
   - kind: ServiceAccount
     name: ibm-vpc-block-controller-sa

assets/rbac/attacher_rolebinding.yaml → assets/rbac/main_provisioner_binding.yaml

@@ -4,11 +4,11 @@ metadata:
   labels:
     addonmanager.kubernetes.io/mode: Reconcile
     app: ibm-vpc-block-csi-driver
-  name: vpc-block-external-attacher-binding
+  name: vpc-block-main-provisioner-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: vpc-block-external-attacher-role
+  name: openshift-csi-main-provisioner-role
 subjects:
   - kind: ServiceAccount
     name: ibm-vpc-block-controller-sa

assets/rbac/resizer_rolebinding.yaml → assets/rbac/main_resizer_binding.yaml

@@ -2,7 +2,7 @@
  kind: ClusterRoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
-   name: vpc-block-external-resizer-binding
+   name: vpc-block-main-resizer-binding
    labels:
      app: ibm-vpc-block-csi-driver
      addonmanager.kubernetes.io/mode: Reconcile
@@ -12,5 +12,5 @@
      namespace: openshift-cluster-csi-drivers
  roleRef:
    kind: ClusterRole
-   name: vpc-block-external-resizer-role
+   name: openshift-csi-main-resizer-role
    apiGroup: rbac.authorization.k8s.io

assets/rbac/snapshotter_binding.yaml → assets/rbac/main_snapshotter_binding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: vpc-block-driver-snapshotter-binding
+  name: vpc-block-main-snapshotter-binding
 subjects:
   - kind: ServiceAccount
     name: ibm-vpc-block-controller-sa
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: vpc-block-driver-snapshotter-role
+  name: openshift-csi-main-snapshotter-role
   apiGroup: rbac.authorization.k8s.io

assets/rbac/volumesnapshot_reader_provisioner_binding.yaml

@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ibm-vpc-block-csi-volumesnapshot-reader-provisioner-binding
+subjects:
+  - kind: ServiceAccount
+    name: ibm-vpc-block-controller-sa
+    namespace: openshift-cluster-csi-drivers
+roleRef:
+  kind: ClusterRole
+  name: openshift-csi-provisioner-volumesnapshot-reader-role
+  apiGroup: rbac.authorization.k8s.io

pkg/operator/starter.go

@@ -95,20 +95,20 @@ func RunOperator(ctx context.Context, controllerConfig *controllercmd.Controller
 			"csidriver.yaml",
 			"node_sa.yaml",
 			"cabundle_cm.yaml",
-			"rbac/attacher_role.yaml",
-			"rbac/attacher_rolebinding.yaml",
-			"rbac/provisioner_binding.yaml",
-			"rbac/provisioner_role.yaml",
+			"rbac/main_attacher_binding.yaml",
+			"rbac/main_provisioner_binding.yaml",
+			"rbac/volumesnapshot_reader_provisioner_binding.yaml",
+			"rbac/configmap_and_secret_reader_provisioner_binding.yaml",
 			"rbac/node_privileged_binding.yaml",
 			"rbac/privileged_role.yaml",
 			"rbac/node_label_updater_binding.yaml",
 			"rbac/label_updater_role.yaml",
-			"rbac/resizer_role.yaml",
-			"rbac/resizer_rolebinding.yaml",
+			"rbac/main_resizer_binding.yaml",
 			"rbac/initcontainer_role.yaml",
 			"rbac/initcontainer_rolebinding.yaml",
-			"rbac/snapshotter_binding.yaml",
-			"rbac/snapshotter_role.yaml",
+			"rbac/main_snapshotter_binding.yaml",
+			"rbac/lease_leader_election_role.yaml",
+			"rbac/lease_leader_election_rolebinding.yaml",
 		},
 	).WithConditionalStaticResourcesController(
 		"IBMBlockDriverConditionalStaticResourcesController",