Skip to content

Commit 990f5b6

Browse files
ousleypousleyp
authored
Merge pull request #64489 from ousleyp/cnv-28780
CNV-28780: RBAC roles for storage
2 parents 0b42f2b + 7ebf092 commit 990f5b6

File tree

3 files changed

+251
-8
lines changed

3 files changed

+251
-8
lines changed

‎modules/virt-default-cluster-roles.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Module included in the following assemblies:
22
//
3-
// * virt/virt-additional-security-privileges-controller-and-launcher.adoc
3+
// * virt/about_virt/virt-security-policies.adoc
44

55
:_content-type: REFERENCE
66
[id="default-cluster-roles-for-virt_{context}"]

‎modules/virt-storage-rbac-roles.adoc

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/about_virt/virt-security-policies.adoc
4+
5+
:_content-type: REFERENCE
6+
[id="virt-storage-rbac-roles_{context}"]
7+
= RBAC roles for storage features in {VirtProductName}
8+
9+
The following permissions are granted to the Containerized Data Importer (CDI), including the `cdi-operator` and `cdi-controller` service accounts.
10+
11+
[id="cluster-wide-rbac-roles-cdi"]
12+
== Cluster-wide RBAC roles
13+
14+
.Aggregated cluster roles for the `cdi.kubevirt.io` API group
15+
[cols="1,2,1",options="header"]
16+
|===
17+
| CDI cluster role
18+
| Resources
19+
| Verbs
20+
21+
.2+.^| `cdi.kubevirt.io:admin`
22+
.^| `datavolumes`, `uploadtokenrequests`
23+
.^| `*` (all)
24+
25+
.^| `datavolumes/source`
26+
.^| `create`
27+
28+
.2+.^| `cdi.kubevirt.io:edit`
29+
.^| `datavolumes`, `uploadtokenrequests`
30+
.^| `*`
31+
32+
.^| `datavolumes/source`
33+
.^| `create`
34+
35+
.2+.^| `cdi.kubevirt.io:view`
36+
.^| `cdiconfigs`, `dataimportcrons`, `datasources`, `datavolumes`, `objecttransfers`, `storageprofiles`, `volumeimportsources`, `volumeuploadsources`, `volumeclonesources`
37+
.^| `get`, `list`, `watch`
38+
39+
.^| `datavolumes/source`
40+
.^| `create`
41+
42+
.^| `cdi.kubevirt.io:config-reader`
43+
.^| `cdiconfigs`, `storageprofiles`
44+
.^| `get`, `list`, `watch`
45+
|===
46+
47+
.Cluster-wide roles for the `cdi-operator` service account
48+
[cols="1,1,2",options="header"]
49+
|===
50+
| API group
51+
| Resources
52+
| Verbs
53+
54+
.^| `rbac.authorization.k8s.io`
55+
.^| `clusterrolebindings`, `clusterroles`
56+
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
57+
58+
.^| `security.openshift.io`
59+
.^| `securitycontextconstraints`
60+
.^| `get`, `list`, `watch`, `update`, `create`
61+
62+
.^| `apiextensions.k8s.io`
63+
.^| `customresourcedefinitions`, `customresourcedefinitions/status`
64+
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
65+
66+
.^| `cdi.kubevirt.io`
67+
.^| `*`
68+
.^| `*`
69+
70+
.^| `upload.cdi.kubevirt.io`
71+
.^| `*`
72+
.^| `*`
73+
74+
.^| `admissionregistration.k8s.io`
75+
.^| `validatingwebhookconfigurations`, `mutatingwebhookconfigurations`
76+
.^| `create`, `list`, `watch`
77+
78+
.^| `admissionregistration.k8s.io`
79+
.^| `validatingwebhookconfigurations`
80+
81+
Allow list: `cdi-api-dataimportcron-validate, cdi-api-populator-validate, cdi-api-datavolume-validate, cdi-api-validate, objecttransfer-api-validate`
82+
.^| `get`, `update`, `delete`
83+
84+
.^| `admissionregistration.k8s.io`
85+
.^| `mutatingwebhookconfigurations`
86+
87+
Allow list: `cdi-api-datavolume-mutate`
88+
.^| `get`, `update`, `delete`
89+
90+
.^| `apiregistration.k8s.io`
91+
.^| `apiservices`
92+
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
93+
|===
94+
95+
.Cluster-wide roles for the `cdi-controller` service account
96+
[cols="1,1,2",options="header"]
97+
|===
98+
| API group
99+
| Resources
100+
| Verbs
101+
102+
.^| `""` (core)
103+
.^| `events`
104+
.^| `create`, `patch`
105+
106+
.^| `""` (core)
107+
.^| `persistentvolumeclaims`
108+
.^| `get`, `list`, `watch`, `create`, `update`, `delete`, `deletecollection`, `patch`
109+
110+
.^| `""` (core)
111+
.^| `persistentvolumes`
112+
.^| `get`, `list`, `watch`, `update`
113+
114+
.^| `""` (core)
115+
.^| `persistentvolumeclaims/finalizers`, `pods/finalizers`
116+
.^| `update`
117+
118+
.^| `""` (core)
119+
.^| `pods`, `services`
120+
.^| `get`, `list`, `watch`, `create`, `delete`
121+
122+
.^| `""` (core)
123+
.^| `configmaps`
124+
.^| `get`, `create`
125+
126+
.^| `storage.k8s.io`
127+
.^| `storageclasses`, `csidrivers`
128+
.^| `get`, `list`, `watch`
129+
130+
.^| `config.openshift.io`
131+
.^| `proxies`
132+
.^| `get`, `list`, `watch`
133+
134+
.^| `cdi.kubevirt.io`
135+
.^| `*`
136+
.^| `*`
137+
138+
.^| `snapshot.storage.k8s.io`
139+
.^| `volumesnapshots`, `volumesnapshotclasses`, `volumesnapshotcontents`
140+
.^| `get`, `list`, `watch`, `create`, `delete`
141+
142+
.^| `snapshot.storage.k8s.io`
143+
.^| `volumesnapshots`
144+
.^| `update`, `deletecollection`
145+
146+
.^| `apiextensions.k8s.io`
147+
.^| `customresourcedefinitions`
148+
.^| `get`, `list`, `watch`
149+
150+
.^| `scheduling.k8s.io`
151+
.^| `priorityclasses`
152+
.^| `get`, `list`, `watch`
153+
154+
.^| `image.openshift.io`
155+
.^| `imagestreams`
156+
.^| `get`, `list`, `watch`
157+
158+
.^| `""` (core)
159+
.^| `secrets`
160+
.^| `create`
161+
162+
.^| `kubevirt.io`
163+
.^| `virtualmachines/finalizers`
164+
.^| `update`
165+
|===
166+
167+
[id="namespaced-rbac-roles-cdi"]
168+
== Namespaced RBAC roles
169+
170+
.Namespaced roles for the `cdi-operator` service account
171+
[cols="1,1,2",options="header"]
172+
|===
173+
| API group
174+
| Resources
175+
| Verbs
176+
177+
.^| `rbac.authorization.k8s.io`
178+
.^| `rolebindings`, `roles`
179+
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
180+
181+
.^| `""` (core)
182+
.^| `serviceaccounts`, `configmaps`, `events`, `secrets`, `services`
183+
.^| `get`, `list`, `watch`, `create`, `update`, `patch`, `delete`
184+
185+
.^| `apps`
186+
.^| `deployments`, `deployments/finalizers`
187+
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
188+
189+
.^| `route.openshift.io`
190+
.^| `routes`, `routes/custom-host`
191+
.^| `get`, `list`, `watch`, `create`, `update`
192+
193+
.^| `config.openshift.io`
194+
.^| `proxies`
195+
.^| `get`, `list`, `watch`
196+
197+
.^| `monitoring.coreos.com`
198+
.^| `servicemonitors`, `prometheusrules`
199+
.^| `get`, `list`, `watch`, `create`, `delete`, `update`, `patch`
200+
201+
.^| `coordination.k8s.io`
202+
.^| `leases`
203+
.^| `get`, `create`, `update`
204+
|===
205+
206+
.Namespaced roles for the `cdi-controller` service account
207+
[cols="1,1,2",options="header"]
208+
|===
209+
| API group
210+
| Resources
211+
| Verbs
212+
213+
.^| `""` (core)
214+
.^| `configmaps`
215+
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
216+
217+
.^| `""` (core)
218+
.^| `secrets`
219+
.^| `get`, `list`, `watch`
220+
221+
.^| `batch`
222+
.^| `cronjobs`
223+
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
224+
225+
.^| `batch`
226+
.^| `jobs`
227+
.^| `create`, `delete`, `list`, `watch`
228+
229+
.^| `coordination.k8s.io`
230+
.^| `leases`
231+
.^| `get`, `create`, `update`
232+
233+
.^| `networking.k8s.io`
234+
.^| `ingresses`
235+
.^| `get`, `list`, `watch`
236+
237+
.^| `route.openshift.io`
238+
.^| `routes`
239+
.^| `get`, `list`, `watch`
240+
|===

‎virt/about_virt/virt-security-policies.adoc

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,23 +16,26 @@ Learn about {VirtProductName} security and authorization.
1616
1717
include::modules/virt-about-workload-security.adoc[leveloffset=+1]
1818

19-
include::modules/virt-additional-scc-for-kubevirt-controller.adoc[leveloffset=+1]
19+
include::modules/virt-automatic-certificates-renewal.adoc[leveloffset=+1]
2020

2121
[id="authorization_virt-security-policies"]
2222
== Authorization
2323

24-
{VirtProductName} uses xref:../../authentication/using-rbac.adoc#using-rbac[role-based access control] (RBAC) for authorization. For example, an administrator can create an RBAC role that provides the permissions required to launch a virtual machine. The administrator can then restrict access to that feature by binding the role to specific users.
24+
{VirtProductName} uses xref:../../authentication/using-rbac.adoc#using-rbac[role-based access control] (RBAC) to define permissions for human users and service accounts. The permissions defined for service accounts control the actions that {VirtProductName} components can perform.
25+
26+
You can also use RBAC roles to manage user access to virtualization features. For example, an administrator can create an RBAC role that provides the permissions required to launch a virtual machine. The administrator can then restrict access by binding the role to specific users.
2527

2628
include::modules/virt-default-cluster-roles.adoc[leveloffset=+2]
2729

28-
[discrete]
30+
include::modules/virt-storage-rbac-roles.adoc[leveloffset=+2]
31+
32+
include::modules/virt-additional-scc-for-kubevirt-controller.adoc[leveloffset=+2]
33+
2934
[role="_additional-resources"]
30-
[id="additional-resources_authorization"]
35+
[id="additional-resources_{context}"]
3136
== Additional resources
3237
* xref:../../authentication/managing-security-context-constraints.adoc#security-context-constraints-about_configuring-internal-oauth[Managing security context constraints]
3338
* xref:../../authentication/using-rbac.adoc#using-rbac[Using RBAC to define and apply permissions]
3439
* xref:../../authentication/using-rbac.adoc#creating-cluster-role_using-rbac[Creating a cluster role]
3540
* xref:../../authentication/using-rbac.adoc#cluster-role-binding-commands_using-rbac[Cluster role binding commands]
36-
* xref:../../virt/virtual_machines/cloning_vms/virt-enabling-user-permissions-to-clone-datavolumes.adoc#virt-enabling-user-permissions-to-clone-datavolumes[Enabling user permissions to clone data volumes across namespaces]
37-
38-
include::modules/virt-automatic-certificates-renewal.adoc[leveloffset=+1]
41+
* xref:../../virt/virtual_machines/cloning_vms/virt-enabling-user-permissions-to-clone-datavolumes.adoc#virt-enabling-user-permissions-to-clone-datavolumes[Enabling user permissions to clone data volumes across namespaces]

0 commit comments

Comments
 (0)