Merge pull request #2775 from OdedViner/ceph_rook_rbac

Reducing the ceph.rook.io group privileges
red-hat-storage · Sep 2, 2024 · b300e13 · b300e13
2 parents b2c67c1 + 7de8ba1
commit b300e13
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 55 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -56,32 +56,16 @@ rules:
   - ceph.rook.io
   resources:
   - cephblockpoolradosnamespaces
-  verbs:
-  - '*'
-  - create
-  - delete
-  - get
-  - list
-  - update
-  - watch
-- apiGroups:
-  - ceph.rook.io
-  resources:
   - cephblockpools
+  - cephclients
   - cephclusters
   - cephfilesystems
+  - cephfilesystemsubvolumegroups
   - cephnfses
   - cephobjectstores
   - cephobjectstoreusers
   - cephrbdmirrors
   verbs:
-  - '*'
-- apiGroups:
-  - ceph.rook.io
-  resources:
-  - cephclients
-  - cephfilesystemsubvolumegroups
-  verbs:
   - create
   - delete
   - get

diff --git a/controllers/storagecluster/reconcile.go b/controllers/storagecluster/reconcile.go
@@ -107,7 +107,7 @@ var validTopologyLabelKeys = []string{
 }
 
 // +kubebuilder:rbac:groups=ocs.openshift.io,resources=*,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=ceph.rook.io,resources=cephclusters;cephblockpools;cephfilesystems;cephnfses;cephobjectstores;cephobjectstoreusers;cephrbdmirrors;cephblockpoolradosnamespaces,verbs=*
+// +kubebuilder:rbac:groups=ceph.rook.io,resources=cephclusters;cephblockpools;cephfilesystems;cephnfses;cephobjectstores;cephobjectstoreusers;cephrbdmirrors;cephblockpoolradosnamespaces,verbs=get;list;watch;create;update;delete
 // +kubebuilder:rbac:groups=noobaa.io,resources=noobaas,verbs=get;list;watch;create;update;delete
 // +kubebuilder:rbac:groups=storage.k8s.io,resources=storageclasses,verbs=watch;create;delete;get;list
 // +kubebuilder:rbac:groups=core,resources=pods;services;serviceaccounts;endpoints;persistentvolumes;persistentvolumeclaims;events;configmaps;secrets;nodes,verbs=*

diff --git a/deploy/csv-templates/ocs-operator.csv.yaml.in b/deploy/csv-templates/ocs-operator.csv.yaml.in
@@ -227,32 +227,16 @@ spec:
           - ceph.rook.io
           resources:
           - cephblockpoolradosnamespaces
-          verbs:
-          - '*'
-          - create
-          - delete
-          - get
-          - list
-          - update
-          - watch
-        - apiGroups:
-          - ceph.rook.io
-          resources:
           - cephblockpools
+          - cephclients
           - cephclusters
           - cephfilesystems
+          - cephfilesystemsubvolumegroups
           - cephnfses
           - cephobjectstores
           - cephobjectstoreusers
           - cephrbdmirrors
           verbs:
-          - '*'
-        - apiGroups:
-          - ceph.rook.io
-          resources:
-          - cephclients
-          - cephfilesystemsubvolumegroups
-          verbs:
           - create
           - delete
           - get

diff --git a/deploy/ocs-operator/manifests/ocs-operator.clusterserviceversion.yaml b/deploy/ocs-operator/manifests/ocs-operator.clusterserviceversion.yaml
@@ -236,32 +236,16 @@ spec:
           - ceph.rook.io
           resources:
           - cephblockpoolradosnamespaces
-          verbs:
-          - '*'
-          - create
-          - delete
-          - get
-          - list
-          - update
-          - watch
-        - apiGroups:
-          - ceph.rook.io
-          resources:
           - cephblockpools
+          - cephclients
           - cephclusters
           - cephfilesystems
+          - cephfilesystemsubvolumegroups
           - cephnfses
           - cephobjectstores
           - cephobjectstoreusers
           - cephrbdmirrors
           verbs:
-          - '*'
-        - apiGroups:
-          - ceph.rook.io
-          resources:
-          - cephclients
-          - cephfilesystemsubvolumegroups
-          verbs:
           - create
           - delete
           - get