@@ -9,29 +9,6 @@ import (
9
9
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
10
10
)
11
11
12
- const (
13
- securityOpenshiftApiGroup string = "security.openshift.io"
14
- rbacAuthorizationApiGroup string = "rbac.authorization.k8s.io"
15
- storageClassesResource string = "storageclasses"
16
- persistentVolumesResource string = "persistentvolumes"
17
- persistentVolumeClaimsResource string = "persistentvolumeclaims"
18
- persistentVolumeClaimsStatusResource string = "persistentvolumeclaims/status"
19
- persistentVolumeClaimsFinalizersResource string = "persistentvolumeclaims/finalizers"
20
- podsResource string = "pods"
21
- eventsResource string = "events"
22
- nodesResource string = "nodes"
23
- csiNodesResource string = "csinodes"
24
- secretsResource string = "secrets"
25
- securityContextConstraintsResource string = "securitycontextconstraints"
26
- verbGet string = "get"
27
- verbList string = "list"
28
- verbWatch string = "watch"
29
- verbCreate string = "create"
30
- verbUpdate string = "update"
31
- verbPatch string = "patch"
32
- verbDelete string = "delete"
33
- )
34
-
35
12
func (c * IBMObjectCSI ) GenerateCSIDriver () * storagev1.CSIDriver {
36
13
defaultFSGroupPolicy := storagev1 .FileFSGroupPolicy
37
14
return & storagev1.CSIDriver {
@@ -75,38 +52,38 @@ func (c *IBMObjectCSI) GenerateExternalProvisionerClusterRole() *rbacv1.ClusterR
75
52
Rules : []rbacv1.PolicyRule {
76
53
{
77
54
APIGroups : []string {"" },
78
- Resources : []string {secretsResource },
79
- Verbs : []string {verbGet , verbList },
55
+ Resources : []string {config . SecretsResource },
56
+ Verbs : []string {config . VerbGet , config . VerbList },
80
57
},
81
58
{
82
59
APIGroups : []string {"" },
83
- Resources : []string {persistentVolumesResource },
84
- Verbs : []string {verbGet , verbList , verbWatch , verbCreate , verbDelete },
60
+ Resources : []string {config . PersistentVolumesResource },
61
+ Verbs : []string {config . VerbGet , config . VerbList , config . VerbWatch , config . VerbCreate , config . VerbDelete },
85
62
},
86
63
{
87
64
APIGroups : []string {"" },
88
- Resources : []string {persistentVolumeClaimsResource },
89
- Verbs : []string {verbGet , verbList , verbWatch , verbUpdate },
65
+ Resources : []string {config . PersistentVolumeClaimsResource },
66
+ Verbs : []string {config . VerbGet , config . VerbList , config . VerbWatch , config . VerbUpdate },
90
67
},
91
68
{
92
69
APIGroups : []string {config .StorageApiGroup },
93
- Resources : []string {storageClassesResource },
94
- Verbs : []string {verbGet , verbList , verbWatch },
70
+ Resources : []string {config . StorageClassesResource },
71
+ Verbs : []string {config . VerbGet , config . VerbList , config . VerbWatch },
95
72
},
96
73
{
97
74
APIGroups : []string {"" },
98
- Resources : []string {eventsResource },
99
- Verbs : []string {verbList , verbWatch , verbCreate , verbUpdate , verbPatch },
75
+ Resources : []string {config . EventsResource },
76
+ Verbs : []string {config . VerbList , config . VerbWatch , config . VerbCreate , config . VerbUpdate , config . VerbPatch },
100
77
},
101
78
{
102
79
APIGroups : []string {config .StorageApiGroup },
103
- Resources : []string {csiNodesResource },
104
- Verbs : []string {verbGet , verbList , verbWatch },
80
+ Resources : []string {config . CsiNodesResource },
81
+ Verbs : []string {config . VerbGet , config . VerbList , config . VerbWatch },
105
82
},
106
83
{
107
84
APIGroups : []string {"" },
108
- Resources : []string {nodesResource },
109
- Verbs : []string {verbGet , verbList , verbWatch },
85
+ Resources : []string {config . NodesResource },
86
+ Verbs : []string {config . VerbGet , config . VerbList , config . VerbWatch },
110
87
},
111
88
},
112
89
}
@@ -127,7 +104,7 @@ func (c *IBMObjectCSI) GenerateExternalProvisionerClusterRoleBinding() *rbacv1.C
127
104
RoleRef : rbacv1.RoleRef {
128
105
Kind : "ClusterRole" ,
129
106
Name : config .GetNameForResource (config .ExternalProvisionerClusterRole , c .Name ),
130
- APIGroup : rbacAuthorizationApiGroup ,
107
+ APIGroup : config . RbacAuthorizationApiGroup ,
131
108
},
132
109
}
133
110
}
@@ -139,8 +116,8 @@ func (c *IBMObjectCSI) GenerateSCCForControllerClusterRole() *rbacv1.ClusterRole
139
116
},
140
117
Rules : []rbacv1.PolicyRule {
141
118
{
142
- APIGroups : []string {securityOpenshiftApiGroup },
143
- Resources : []string {securityContextConstraintsResource },
119
+ APIGroups : []string {config . SecurityOpenshiftApiGroup },
120
+ Resources : []string {config . SecurityContextConstraintsResource },
144
121
ResourceNames : []string {"anyuid" },
145
122
Verbs : []string {"use" },
146
123
},
@@ -163,7 +140,7 @@ func (c *IBMObjectCSI) GenerateSCCForControllerClusterRoleBinding() *rbacv1.Clus
163
140
RoleRef : rbacv1.RoleRef {
164
141
Kind : "ClusterRole" ,
165
142
Name : config .GetNameForResource (config .CSIControllerSCCClusterRole , c .Name ),
166
- APIGroup : rbacAuthorizationApiGroup ,
143
+ APIGroup : config . RbacAuthorizationApiGroup ,
167
144
},
168
145
}
169
146
}
@@ -175,15 +152,15 @@ func (c *IBMObjectCSI) GenerateSCCForNodeClusterRole() *rbacv1.ClusterRole {
175
152
},
176
153
Rules : []rbacv1.PolicyRule {
177
154
{
178
- APIGroups : []string {securityOpenshiftApiGroup },
179
- Resources : []string {securityContextConstraintsResource },
155
+ APIGroups : []string {config . SecurityOpenshiftApiGroup },
156
+ Resources : []string {config . SecurityContextConstraintsResource },
180
157
ResourceNames : []string {"privileged" },
181
158
Verbs : []string {"use" },
182
159
},
183
160
{
184
161
APIGroups : []string {"" },
185
- Resources : []string {nodesResource },
186
- Verbs : []string {verbGet },
162
+ Resources : []string {config . NodesResource },
163
+ Verbs : []string {config . VerbGet },
187
164
},
188
165
},
189
166
}
@@ -204,7 +181,7 @@ func (c *IBMObjectCSI) GenerateSCCForNodeClusterRoleBinding() *rbacv1.ClusterRol
204
181
RoleRef : rbacv1.RoleRef {
205
182
Kind : "ClusterRole" ,
206
183
Name : config .GetNameForResource (config .CSINodeSCCClusterRole , c .Name ),
207
- APIGroup : rbacAuthorizationApiGroup ,
184
+ APIGroup : config . RbacAuthorizationApiGroup ,
208
185
},
209
186
}
210
187
}
0 commit comments