Skip to content

Commit d0dde33

Browse files
pohlypohly
committed
deploy: split out RBAC definitions
Splitting out the RBAC definitions into a separate file has the advantage that it can be used as-is without editing in other deployments. For example, the kubernetes-csi/docs example can use this rbac.yaml file instead of a local copy. While at it, the upstream external-provisioner RBAC file gets used, which fixes the too broad permissions for "endpoints".
1 parent 608b686 commit d0dde33

File tree

5 files changed

+188
-54
lines changed

5 files changed

+188
-54
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,10 @@ $ csi-snapshotter -kubeconfig ~/.kube/config -v 5 -csi-address /run/csi/socket
4141

4242
### Running in a statefulset
4343

44-
It is necessary to create a new service account and give it enough privileges to run the snapshotter. We provide one omnipotent yaml file that creates everything that's necessary, however it should be split into multiple files in production.
44+
It is necessary to create a new service account and give it enough privileges to run the snapshotter. We provide .yaml files that deploy for use together with the hostpath example driver. A real production deployment must customize them:
4545

4646
```
47-
$ kubectl create -f deploy/kubernetes/statefulset.yaml
47+
$ for i in $(find deploy/kubernetes -name '*.yaml'); do kubectl create -f $i; done
4848
```
4949

5050
## Testing

‎deploy/kubernetes/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
rbac-external-provisioner.yaml was copied from https://github.com/kubernetes-csi/external-provisioner/blob/master/deploy/kubernetes/rbac.yaml
2+
and must be refreshed when updating the external-provisioner image in setup-csi-snapshotter.yaml

‎deploy/kubernetes/rbac-external-provisioner.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# This YAML file contains all RBAC objects that are necessary to run external
2+
# CSI provisioner.
3+
#
4+
# In production, each CSI driver deployment has to be customized:
5+
# - to avoid conflicts, use non-default namespace and different names
6+
# for non-namespaced entities like the ClusterRole
7+
# - decide whether the deployment replicates the external CSI
8+
# provisioner, in which case leadership election must be enabled;
9+
# this influences the RBAC setup, see below
10+
11+
apiVersion: v1
12+
kind: ServiceAccount
13+
metadata:
14+
name: csi-provisioner
15+
# replace with non-default namespace name
16+
namespace: default
17+
18+
---
19+
kind: ClusterRole
20+
apiVersion: rbac.authorization.k8s.io/v1
21+
metadata:
22+
name: external-provisioner-runner
23+
rules:
24+
- apiGroups: [""]
25+
resources: ["secrets"]
26+
verbs: ["get", "list"]
27+
- apiGroups: [""]
28+
resources: ["persistentvolumes"]
29+
verbs: ["get", "list", "watch", "create", "delete"]
30+
- apiGroups: [""]
31+
resources: ["persistentvolumeclaims"]
32+
verbs: ["get", "list", "watch", "update"]
33+
- apiGroups: ["storage.k8s.io"]
34+
resources: ["storageclasses"]
35+
verbs: ["get", "list", "watch"]
36+
- apiGroups: [""]
37+
resources: ["events"]
38+
verbs: ["list", "watch", "create", "update", "patch"]
39+
- apiGroups: ["snapshot.storage.k8s.io"]
40+
resources: ["volumesnapshots"]
41+
verbs: ["get", "list"]
42+
- apiGroups: ["snapshot.storage.k8s.io"]
43+
resources: ["volumesnapshotcontents"]
44+
verbs: ["get", "list"]
45+
46+
---
47+
kind: ClusterRoleBinding
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
metadata:
50+
name: csi-provisioner-role
51+
subjects:
52+
- kind: ServiceAccount
53+
name: csi-provisioner
54+
# replace with non-default namespace name
55+
namespace: default
56+
roleRef:
57+
kind: ClusterRole
58+
name: external-provisioner-runner
59+
apiGroup: rbac.authorization.k8s.io
60+
61+
---
62+
# Provisioner must be able to work with endpoints in current namespace
63+
# if (and only if) leadership election is enabled
64+
kind: Role
65+
apiVersion: rbac.authorization.k8s.io/v1
66+
metadata:
67+
# replace with non-default namespace name
68+
namespace: default
69+
name: external-provisioner-cfg
70+
rules:
71+
- apiGroups: [""]
72+
resources: ["endpoints"]
73+
verbs: ["get", "watch", "list", "delete", "update", "create"]
74+
75+
---
76+
kind: RoleBinding
77+
apiVersion: rbac.authorization.k8s.io/v1
78+
metadata:
79+
name: csi-provisioner-role-cfg
80+
# replace with non-default namespace name
81+
namespace: default
82+
subjects:
83+
- kind: ServiceAccount
84+
name: csi-provisioner
85+
# replace with non-default namespace name
86+
namespace: default
87+
roleRef:
88+
kind: Role
89+
name: external-provisioner-cfg
90+
apiGroup: rbac.authorization.k8s.io

‎deploy/kubernetes/rbac.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Together with the RBAC file for external-provisioner, this YAML file
2+
# contains all RBAC objects that are necessary to run external CSI
3+
# snapshotter.
4+
#
5+
# In production, each CSI driver deployment has to be customized:
6+
# - to avoid conflicts, use non-default namespace and different names
7+
# for non-namespaced entities like the ClusterRole
8+
# - optionally rename the non-namespaced ClusterRole if there
9+
# are conflicts with other deployments
10+
11+
apiVersion: v1
12+
kind: ServiceAccount
13+
metadata:
14+
name: csi-snapshotter
15+
16+
---
17+
kind: ClusterRole
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
metadata:
20+
# rename if there are conflicts
21+
name: external-snapshotter-runner
22+
rules:
23+
- apiGroups: [""]
24+
resources: ["persistentvolumes"]
25+
verbs: ["get", "list", "watch", "create", "delete"]
26+
- apiGroups: [""]
27+
resources: ["persistentvolumeclaims"]
28+
verbs: ["get", "list", "watch", "update"]
29+
- apiGroups: ["storage.k8s.io"]
30+
resources: ["storageclasses"]
31+
verbs: ["get", "list", "watch"]
32+
- apiGroups: [""]
33+
resources: ["events"]
34+
verbs: ["list", "watch", "create", "update", "patch"]
35+
- apiGroups: [""]
36+
resources: ["secrets"]
37+
verbs: ["get", "list"]
38+
- apiGroups: ["snapshot.storage.k8s.io"]
39+
resources: ["volumesnapshotclasses"]
40+
verbs: ["get", "list", "watch"]
41+
- apiGroups: ["snapshot.storage.k8s.io"]
42+
resources: ["volumesnapshotcontents"]
43+
verbs: ["create", "get", "list", "watch", "update", "delete"]
44+
- apiGroups: ["snapshot.storage.k8s.io"]
45+
resources: ["volumesnapshots"]
46+
verbs: ["get", "list", "watch", "update"]
47+
- apiGroups: ["apiextensions.k8s.io"]
48+
resources: ["customresourcedefinitions"]
49+
verbs: ["create", "list", "watch", "delete"]
50+
51+
---
52+
kind: ClusterRoleBinding
53+
apiVersion: rbac.authorization.k8s.io/v1
54+
metadata:
55+
name: csi-snapshotter-role
56+
subjects:
57+
- kind: ServiceAccount
58+
name: csi-snapshotter
59+
# replace with non-default namespace name
60+
namespace: default
61+
roleRef:
62+
kind: ClusterRole
63+
# change the name also here if the ClusterRole gets renamed
64+
name: external-snapshotter-runner
65+
apiGroup: rbac.authorization.k8s.io

‎deploy/kubernetes/setup-csi-snapshotter.yaml‎

Lines changed: 29 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,44 @@
1-
# This YAML file contains all API objects that are necessary to run external
2-
# CSI snapshotter.
1+
# This YAML file shows how to deploy the CSI snapshotter together
2+
# with the hostpath CSI driver. It depends on the RBAC rules
3+
# from rbac.yaml and rbac-external-provisioner.yaml.
34
#
4-
# In production, this needs to be in separate files, e.g. service account and
5-
# role and role binding needs to be created once, while stateful set may
6-
# require some tuning.
7-
#
8-
# In addition, hostpath CSI driver is hardcoded as the CSI driver.
9-
apiVersion: v1
10-
kind: ServiceAccount
11-
metadata:
12-
name: csi-snapshotter
13-
5+
# Because external-snapshotter and external-provisioner get
6+
# deployed in the same pod, we have to merge the permissions
7+
# for the provisioner into the service account. This is not
8+
# necessary when deploying separately.
9+
1410
---
15-
kind: ClusterRole
11+
kind: ClusterRoleBinding
1612
apiVersion: rbac.authorization.k8s.io/v1
1713
metadata:
18-
name: external-snapshotter-runner
19-
rules:
20-
- apiGroups: [""]
21-
resources: ["persistentvolumes"]
22-
verbs: ["get", "list", "watch", "create", "delete"]
23-
- apiGroups: [""]
24-
resources: ["persistentvolumeclaims"]
25-
verbs: ["get", "list", "watch", "update"]
26-
- apiGroups: ["storage.k8s.io"]
27-
resources: ["storageclasses"]
28-
verbs: ["get", "list", "watch"]
29-
- apiGroups: [""]
30-
resources: ["events"]
31-
verbs: ["list", "watch", "create", "update", "patch"]
32-
- apiGroups: [""]
33-
resources: ["endpoints"]
34-
verbs: ["list", "watch", "create", "update", "delete", "get"]
35-
- apiGroups: [""]
36-
resources: ["secrets"]
37-
verbs: ["get", "list"]
38-
- apiGroups: ["snapshot.storage.k8s.io"]
39-
resources: ["volumesnapshotclasses"]
40-
verbs: ["get", "list", "watch"]
41-
- apiGroups: ["snapshot.storage.k8s.io"]
42-
resources: ["volumesnapshotcontents"]
43-
verbs: ["create", "get", "list", "watch", "update", "delete"]
44-
- apiGroups: ["snapshot.storage.k8s.io"]
45-
resources: ["volumesnapshots"]
46-
verbs: ["get", "list", "watch", "update"]
47-
- apiGroups: ["apiextensions.k8s.io"]
48-
resources: ["customresourcedefinitions"]
49-
verbs: ["create", "list", "watch", "delete"]
50-
14+
name: csi-snapshotter-provisioner-role
15+
subjects:
16+
- kind: ServiceAccount
17+
name: csi-snapshotter # from rbac.yaml
18+
# replace with non-default namespace name
19+
namespace: default
20+
roleRef:
21+
kind: ClusterRole
22+
name: external-provisioner-runner # from rbac-external-provisioner.yaml
23+
apiGroup: rbac.authorization.k8s.io
24+
5125
---
52-
kind: ClusterRoleBinding
26+
kind: RoleBinding
5327
apiVersion: rbac.authorization.k8s.io/v1
5428
metadata:
55-
name: csi-snapshotter-role
29+
name: csi-snapshotter-provisioner-role-cfg
30+
# replace with non-default namespace name
31+
namespace: default
5632
subjects:
5733
- kind: ServiceAccount
58-
name: csi-snapshotter
34+
name: csi-snapshotter # from rbac.yaml
35+
# replace with non-default namespace name
5936
namespace: default
6037
roleRef:
61-
kind: ClusterRole
62-
name: external-snapshotter-runner
38+
kind: Role
39+
name: external-provisioner-cfg # from rbac-external-provisioner.yaml
6340
apiGroup: rbac.authorization.k8s.io
64-
41+
6542
---
6643
kind: Service
6744
apiVersion: v1

0 commit comments

Comments
 (0)