STOR-1065: Rework sidecar bindings to bind common ClusterRoles

PR openshift/cluster-storage-operator#379 published builiding blocks of sidecar ClusterRoles. Now, azure-disk csi driver operator may compose its sidecars ClusterRoles from those building blocks. This PR also moves permissions for `leases` resource from ClusterRole to per-namespace Role (`assets/rbac/lease_leader_election_role.yaml`).
openshift · Jun 28, 2023 · 9a3135a · 9a3135a
1 parent e7c30d5
commit 9a3135a
Show file tree

Hide file tree

Showing 12 changed files with 47 additions and 116 deletions.
diff --git a/assets/rbac/attacher_role.yaml b/assets/rbac/attacher_role.yaml
diff --git a/assets/rbac/lease_leader_election_role.yaml b/assets/rbac/lease_leader_election_role.yaml
@@ -0,0 +1,10 @@
+# Role for electing leader by the operator
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: azure-disk-csi-driver-lease-leader-election
+  namespace: openshift-cluster-csi-drivers
+rules:
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "watch", "list", "delete", "update", "create"]
diff --git a/assets/rbac/lease_leader_election_rolebinding.yaml b/assets/rbac/lease_leader_election_rolebinding.yaml
@@ -0,0 +1,14 @@
+# Grant controller access to leases
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: azure-disk-csi-driver-lease-leader-election
+  namespace: openshift-cluster-csi-drivers
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: azure-disk-csi-driver-lease-leader-election
+subjects:
+- kind: ServiceAccount
+  name: azure-disk-csi-driver-controller-sa
+  namespace: openshift-cluster-csi-drivers
diff --git a/assets/rbac/attacher_binding.yaml → assets/rbac/main_attacher_binding.yaml b/assets/rbac/attacher_binding.yaml → assets/rbac/main_attacher_binding.yaml
@@ -8,5 +8,5 @@ subjects:
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: azure-disk-external-attacher-role
+  name: openshift-csi-main-attacher-role
   apiGroup: rbac.authorization.k8s.io
diff --git a/assets/rbac/provisioner_binding.yaml → assets/rbac/main_provisioner_binding.yaml b/assets/rbac/provisioner_binding.yaml → assets/rbac/main_provisioner_binding.yaml
@@ -8,5 +8,5 @@ subjects:
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: azure-disk-external-provisioner-role
+  name: openshift-csi-main-provisioner-role
   apiGroup: rbac.authorization.k8s.io
diff --git a/assets/rbac/resizer_binding.yaml → assets/rbac/main_resizer_binding.yaml b/assets/rbac/resizer_binding.yaml → assets/rbac/main_resizer_binding.yaml
@@ -8,5 +8,5 @@ subjects:
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: azure-disk-external-resizer-role
+  name: openshift-csi-main-resizer-role
   apiGroup: rbac.authorization.k8s.io
diff --git a/assets/rbac/snapshotter_binding.yaml → assets/rbac/main_snapshotter_binding.yaml b/assets/rbac/snapshotter_binding.yaml → assets/rbac/main_snapshotter_binding.yaml
@@ -8,5 +8,5 @@ subjects:
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: azure-disk-external-snapshotter-role
+  name: openshift-csi-main-snapshotter-role
   apiGroup: rbac.authorization.k8s.io
diff --git a/assets/rbac/provisioner_role.yaml b/assets/rbac/provisioner_role.yaml
diff --git a/assets/rbac/resizer_role.yaml b/assets/rbac/resizer_role.yaml
diff --git a/assets/rbac/snapshotter_role.yaml b/assets/rbac/snapshotter_role.yaml
diff --git a/assets/rbac/storageclass_reader_resizer_binding.yaml b/assets/rbac/storageclass_reader_resizer_binding.yaml
@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: azure-disk-storageclass-reader-resizer-binding
+subjects:
+  - kind: ServiceAccount
+    name: azure-disk-csi-driver-controller-sa
+    namespace: openshift-cluster-csi-drivers
+roleRef:
+  kind: ClusterRole
+  name: openshift-csi-resizer-storageclass-reader-role
+  apiGroup: rbac.authorization.k8s.io
diff --git a/pkg/operator/starter.go b/pkg/operator/starter.go
@@ -114,21 +114,20 @@ func RunOperator(ctx context.Context, controllerConfig *controllercmd.Controller
 		kubeInformersForNamespaces,
 		assets.ReadFile,
 		[]string{
-			"rbac/attacher_role.yaml",
-			"rbac/attacher_binding.yaml",
+			"rbac/main_attacher_binding.yaml",
 			"rbac/privileged_role.yaml",
 			"rbac/controller_privileged_binding.yaml",
 			"rbac/node_privileged_binding.yaml",
-			"rbac/provisioner_role.yaml",
-			"rbac/provisioner_binding.yaml",
-			"rbac/resizer_role.yaml",
-			"rbac/resizer_binding.yaml",
-			"rbac/snapshotter_role.yaml",
-			"rbac/snapshotter_binding.yaml",
+			"rbac/main_provisioner_binding.yaml",
+			"rbac/main_resizer_binding.yaml",
+			"rbac/storageclass_reader_resizer_binding.yaml",
+			"rbac/main_snapshotter_binding.yaml",
 			"rbac/kube_rbac_proxy_role.yaml",
 			"rbac/kube_rbac_proxy_binding.yaml",
 			"rbac/prometheus_role.yaml",
 			"rbac/prometheus_rolebinding.yaml",
+			"rbac/lease_leader_election_role.yaml",
+			"rbac/lease_leader_election_rolebinding.yaml",
 			"controller_pdb.yaml",
 			"csidriver.yaml",
 			"service.yaml",