Revert "STOR-1065: Rework sidecar bindings to bind common ClusterRoles"

assets/rbac/main_attacher_binding.yaml → assets/rbac/attacher_binding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: openstack-cinder-csi-main-attacher-binding
+  name: openstack-cinder-csi-attacher-binding
 subjects:
   - kind: ServiceAccount
     name: openstack-cinder-csi-driver-controller-sa
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: openshift-csi-main-attacher-role
+  name: openstack-cinder-external-attacher-role
   apiGroup: rbac.authorization.k8s.io

assets/rbac/attacher_role.yaml

@@ -0,0 +1,20 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openstack-cinder-external-attacher-role
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["csinodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments/status"]
+    verbs: ["patch"]

assets/rbac/main_snapshotter_binding.yaml → assets/rbac/provisioner_binding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: openstack-cinder-csi-main-snapshotter-binding
+  name: openstack-cinder-csi-provisioner-binding
 subjects:
   - kind: ServiceAccount
     name: openstack-cinder-csi-driver-controller-sa
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: openshift-csi-main-snapshotter-role
+  name: openstack-cinder-external-provisioner-role
   apiGroup: rbac.authorization.k8s.io

assets/rbac/provisioner_role.yaml

@@ -0,0 +1,29 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openstack-cinder-external-provisioner-role
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["get", "list"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents"]
+    verbs: ["get", "list"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["csinodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]

assets/rbac/main_resizer_binding.yaml → assets/rbac/resizer_binding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: openstack-cinder-main-resizer-binding
+  name: openstack-cinder-csi-resizer-binding
 subjects:
   - kind: ServiceAccount
     name: openstack-cinder-csi-driver-controller-sa
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: openshift-csi-main-resizer-role
+  name: openstack-cinder-external-resizer-role
   apiGroup: rbac.authorization.k8s.io

assets/rbac/resizer_role.yaml

@@ -0,0 +1,23 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openstack-cinder-external-resizer-role
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims/status"]
+    verbs: ["update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]

assets/rbac/main_provisioner_binding.yaml → assets/rbac/snapshotter_binding.yaml

@@ -1,12 +1,12 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: openstack-cinder-csi-main-provisioner-binding
+  name: openstack-cinder-csi-snapshotter-binding
 subjects:
   - kind: ServiceAccount
     name: openstack-cinder-csi-driver-controller-sa
     namespace: openshift-cluster-csi-drivers
 roleRef:
   kind: ClusterRole
-  name: openshift-csi-main-provisioner-role
+  name: openstack-cinder-external-snapshotter-role
   apiGroup: rbac.authorization.k8s.io

assets/rbac/snapshotter_role.yaml

@@ -0,0 +1,38 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openstack-cinder-external-snapshotter-role
+rules:
+- apiGroups: [""]
+  resources: ["persistentvolumes"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["storage.k8s.io"]
+  resources: ["storageclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["list", "watch", "create", "update", "patch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotcontents"]
+  verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotcontents/status"]
+  verbs: ["update", "patch"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshots"]
+  verbs: ["get", "list", "watch", "update"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["create", "list", "watch", "delete"]
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "watch", "list", "delete", "update", "create"]

pkg/operator/starter.go

@@ -94,21 +94,21 @@ func RunOperator(ctx context.Context, controllerConfig *controllercmd.Controller
 			"node_sa.yaml",
 			"service.yaml",
 			"cabundle_cm.yaml",
-			"rbac/main_attacher_binding.yaml",
+			"rbac/attacher_role.yaml",
+			"rbac/attacher_binding.yaml",
 			"rbac/privileged_role.yaml",
 			"rbac/controller_privileged_binding.yaml",
 			"rbac/node_privileged_binding.yaml",
-			"rbac/main_provisioner_binding.yaml",
-			"rbac/volumesnapshot_reader_provisioner_binding.yaml",
-			"rbac/main_resizer_binding.yaml",
-			"rbac/storageclass_reader_resizer_binding.yaml",
-			"rbac/main_snapshotter_binding.yaml",
+			"rbac/provisioner_role.yaml",
+			"rbac/provisioner_binding.yaml",
+			"rbac/resizer_role.yaml",
+			"rbac/resizer_binding.yaml",
+			"rbac/snapshotter_role.yaml",
+			"rbac/snapshotter_binding.yaml",
 			"rbac/kube_rbac_proxy_role.yaml",
 			"rbac/kube_rbac_proxy_binding.yaml",
 			"rbac/prometheus_role.yaml",
 			"rbac/prometheus_rolebinding.yaml",
-			"rbac/lease_leader_election_role.yaml",
-			"rbac/lease_leader_election_rolebinding.yaml",
 		},
 	).WithConditionalStaticResourcesController(
 		"OpenStackCinderDriverConditionalStaticResourcesController",