Merge pull request #140 from ZeroMagic/separate-secret

chore: separate secret RBAC

Author: andyzhangx

charts/latest/blobfuse-csi-driver/templates/rbac-csi-blobfuse-controller.yaml

@@ -140,4 +140,30 @@ roleRef:
   kind: ClusterRole
   name: blobfuse-external-snapshotter-role
   apiGroup: rbac.authorization.k8s.io
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: csi-blobfuse-controller-secret-role
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: csi-blobfuse-controller-secret-binding
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: csi-blobfuse-controller-sa
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: csi-blobfuse-controller-secret-role
+  apiGroup: rbac.authorization.k8s.io
 {{ end }}

…/templates/rbac-csi-blobfuse-secret.yaml …er/templates/rbac-csi-blobfuse-node.yamlcharts/latest/blobfuse-csi-driver/templates/rbac-csi-blobfuse-secret.yaml renamed to charts/latest/blobfuse-csi-driver/templates/rbac-csi-blobfuse-node.yaml charts/latest/blobfuse-csi-driver/templates/rbac-csi-blobfuse-secret.yaml renamed to charts/latest/blobfuse-csi-driver/templates/rbac-csi-blobfuse-node.yaml

@@ -4,7 +4,7 @@ kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: csi-blobfuse-secret-role
+  name: csi-blobfuse-node-secret-role
 rules:
   - apiGroups: [""]
     resources: ["secrets"]
@@ -14,17 +14,14 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: csi-blobfuse-secret-binding
+  name: csi-blobfuse-node-secret-binding
   namespace: {{ .Release.Namespace }}
 subjects:
-  - kind: ServiceAccount
-    name: csi-blobfuse-controller-sa
-    namespace: {{ .Release.Namespace }}
   - kind: ServiceAccount
     name: csi-blobfuse-node-sa
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: csi-blobfuse-secret-role
+  name: csi-blobfuse-node-secret-role
   apiGroup: rbac.authorization.k8s.io
 {{ end }}

deploy/install-driver.sh

@@ -37,7 +37,6 @@ echo "Installing Blobfuse CSI driver, version: $ver ..."
 kubectl apply -f $repo/crd-csi-node-info.yaml
 kubectl apply -f $repo/rbac-csi-blobfuse-controller.yaml
 kubectl apply -f $repo/rbac-csi-blobfuse-node.yaml
-kubectl apply -f $repo/rbac-csi-blobfuse-secret.yaml
 kubectl apply -f $repo/csi-blobfuse-controller.yaml
 kubectl apply -f $repo/csi-blobfuse-driver.yaml
 kubectl apply -f $repo/csi-blobfuse-node.yaml

deploy/rbac-csi-blobfuse-controller.yaml

@@ -137,3 +137,29 @@ roleRef:
   kind: ClusterRole
   name: blobfuse-external-snapshotter-role
   apiGroup: rbac.authorization.k8s.io
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: csi-blobfuse-controller-secret-role
+  namespace: kube-system
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: csi-blobfuse-controller-secret-binding
+  namespace: kube-system
+subjects:
+  - kind: ServiceAccount
+    name: csi-blobfuse-controller-sa
+    namespace: kube-system
+roleRef:
+  kind: ClusterRole
+  name: csi-blobfuse-controller-secret-role
+  apiGroup: rbac.authorization.k8s.io

deploy/rbac-csi-blobfuse-node.yaml

@@ -9,7 +9,7 @@ metadata:
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: csi-blobfuse-secret-role
+  name: csi-blobfuse-node-secret-role
   namespace: kube-system
 rules:
   - apiGroups: [""]
@@ -20,16 +20,13 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: csi-blobfuse-secret-binding
+  name: csi-blobfuse-node-secret-binding
   namespace: kube-system
 subjects:
-  - kind: ServiceAccount
-    name: csi-blobfuse-controller-sa
-    namespace: kube-system
   - kind: ServiceAccount
     name: csi-blobfuse-node-sa
     namespace: kube-system
 roleRef:
   kind: ClusterRole
-  name: csi-blobfuse-secret-role
+  name: csi-blobfuse-node-secret-role
   apiGroup: rbac.authorization.k8s.io

deploy/rbac-csi-blobfuse-secret.yaml

@@ -40,5 +40,4 @@ kubectl delete -f $repo/csi-blobfuse-node.yaml --ignore-not-found
 kubectl delete -f $repo/crd-csi-node-info.yaml --ignore-not-found
 kubectl delete -f $repo/rbac-csi-blobfuse-controller.yaml --ignore-not-found
 kubectl delete -f $repo/rbac-csi-blobfuse-node.yaml --ignore-not-found
-kubectl delete -f $repo/rbac-csi-blobfuse-secret.yaml --ignore-not-found
 echo 'Uninstalled Blobfuse CSI driver successfully.'