1+ {{ if .Values.rbac.create }}
2+ # This YAML file contains Cluster Role objects,
3+ # which are necessary to run cloudstack-csi-controller
4+ {{ $enableLeaderElection := gt (int .Values.controller.replicaCount) 1 }}
5+ ---
6+ # external Attacher
7+ kind : ClusterRole
8+ apiVersion : rbac.authorization.k8s.io/v1
9+ metadata :
10+ name : csi-attacher-role
11+ annotations :
12+ {{- with .Values.commonAnnotations }}
13+ {{- toYaml . | nindent 4 }}
14+ {{- end }}
15+ rules :
16+ - apiGroups : [""]
17+ resources : ["persistentvolumes"]
18+ verbs : ["get", "list", "watch", "patch"]
19+ - apiGroups : ["storage.k8s.io"]
20+ resources : ["csinodes"]
21+ verbs : ["get", "list", "watch"]
22+ - apiGroups : ["storage.k8s.io"]
23+ resources : ["volumeattachments"]
24+ verbs : ["get", "list", "watch", "patch"]
25+ - apiGroups : ["storage.k8s.io"]
26+ resources : ["volumeattachments/status"]
27+ verbs : ["patch"]
28+ {{- if $enableLeaderElection}}
29+ # leader election
30+ - apiGroups : [coordination.k8s.io]
31+ resources : [leases]
32+ verbs : ["get", "watch", "list", "delete", "update", "create"]
33+ {{- end}}
34+ ---
35+ # external Provisioner
36+ kind : ClusterRole
37+ apiVersion : rbac.authorization.k8s.io/v1
38+ metadata :
39+ name : csi-provisioner-role
40+ annotations :
41+ {{- with .Values.commonAnnotations }}
42+ {{- toYaml . | nindent 4 }}
43+ {{- end }}
44+ rules :
45+ - apiGroups : [""]
46+ resources : ["persistentvolumes"]
47+ verbs : ["get", "list", "watch", "create", "delete"]
48+ - apiGroups : [""]
49+ resources : ["persistentvolumeclaims"]
50+ verbs : ["get", "list", "watch", "update"]
51+ - apiGroups : ["storage.k8s.io"]
52+ resources : ["storageclasses"]
53+ verbs : ["get", "list", "watch"]
54+ - apiGroups : [""]
55+ resources : ["nodes"]
56+ verbs : ["get", "list", "watch"]
57+ - apiGroups : ["storage.k8s.io"]
58+ resources : ["csinodes"]
59+ verbs : ["get", "list", "watch"]
60+ - apiGroups : [""]
61+ resources : ["events"]
62+ verbs : ["list", "watch", "create", "update", "patch"]
63+ - apiGroups : ["snapshot.storage.k8s.io"]
64+ resources : ["volumesnapshots"]
65+ verbs : ["get", "list"]
66+ - apiGroups : ["snapshot.storage.k8s.io"]
67+ resources : ["volumesnapshotcontents"]
68+ verbs : ["get", "list"]
69+ {{- if $enableLeaderElection}}
70+ # leader election
71+ - apiGroups : [coordination.k8s.io]
72+ resources : [leases]
73+ verbs : ["get", "watch", "list", "delete", "update", "create"]
74+ {{- end}}
75+ ---
76+ # external Resizer
77+ kind : ClusterRole
78+ apiVersion : rbac.authorization.k8s.io/v1
79+ metadata :
80+ name : csi-resizer-role
81+ rules :
82+ # The following rule should be uncommented for plugins that require secrets
83+ # for provisioning.
84+ # - apiGroups: [""]
85+ # resources: ["secrets"]
86+ # verbs: ["get", "list", "watch"]
87+ - apiGroups : [""]
88+ resources : ["persistentvolumes"]
89+ verbs : ["get", "list", "watch", "patch"]
90+ - apiGroups : [""]
91+ resources : ["persistentvolumeclaims"]
92+ verbs : ["get", "list", "watch"]
93+ - apiGroups : [""]
94+ resources : ["pods"]
95+ verbs : ["get", "list", "watch"]
96+ - apiGroups : [""]
97+ resources : ["persistentvolumeclaims/status"]
98+ verbs : ["patch"]
99+ - apiGroups : [""]
100+ resources : ["events"]
101+ verbs : ["list", "watch", "create", "update", "patch"]
102+ {{- if $enableLeaderElection}}
103+ # leader election
104+ - apiGroups : [coordination.k8s.io]
105+ resources : [leases]
106+ verbs : ["get", "watch", "list", "delete", "update", "create"]
107+ {{- end}}
108+ {{- end}}
0 commit comments