From 4e7eca7b31339166b2e73b305a242763ffb0bfe5 Mon Sep 17 00:00:00 2001 From: Jan Safranek Date: Tue, 28 Aug 2018 14:57:46 +0200 Subject: [PATCH] Add new RBAC rules for CSIDriver A/D controller and nodes need to watch CSIDrivers to know if they should send pod information in NodePublish. --- .../auth/authorizer/rbac/bootstrappolicy/controller_policy.go | 3 +++ plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go index ca81758fea4..939ed861f71 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go @@ -73,6 +73,9 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding) if utilfeature.DefaultFeatureGate.Enabled(features.CSIPersistentVolume) { role.Rules = append(role.Rules, rbacv1helpers.NewRule("get", "create", "delete", "list", "watch").Groups(storageGroup).Resources("volumeattachments").RuleOrDie()) + if utilfeature.DefaultFeatureGate.Enabled(features.CSISkipAttach) { + role.Rules = append(role.Rules, rbacv1helpers.NewRule("get", "watch", "list").Groups("csi.storage.k8s.io").Resources("csidrivers").RuleOrDie()) + } } return role diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go index 05366f6ed59..5909c4daf15 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go @@ -159,6 +159,10 @@ func NodeRules() []rbacv1.PolicyRule { if utilfeature.DefaultFeatureGate.Enabled(features.CSIPersistentVolume) { volAttachRule := rbacv1helpers.NewRule("get").Groups(storageGroup).Resources("volumeattachments").RuleOrDie() nodePolicyRules = append(nodePolicyRules, volAttachRule) + if utilfeature.DefaultFeatureGate.Enabled(features.CSISkipAttach) { + csiDriverRule := rbacv1helpers.NewRule("get", "watch", "list").Groups("csi.storage.k8s.io").Resources("csidrivers").RuleOrDie() + nodePolicyRules = append(nodePolicyRules, csiDriverRule) + } } // Node leases