1151 lines
30 KiB
YAML
1151 lines
30 KiB
YAML
###################################################################################################################
|
|
# Create the common resources that are necessary to start the operator and the ceph cluster.
|
|
# These resources *must* be created before the operator.yaml and cluster.yaml or their variants.
|
|
# The samples all assume that a single operator will manage a single cluster crd in the same "rook-ceph" namespace.
|
|
#
|
|
# If the operator needs to manage multiple clusters (in different namespaces), see the section below
|
|
# for "cluster-specific resources". The resources below that section will need to be created for each namespace
|
|
# where the operator needs to manage the cluster. The resources above that section do not be created again.
|
|
#
|
|
# Most of the sections are prefixed with a 'OLM' keyword which is used to build our CSV for an OLM (Operator Life Cycle manager)
|
|
###################################################################################################################
|
|
|
|
# Namespace where the operator and other rook resources are created
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: rook-ceph # namespace:cluster
|
|
# OLM: BEGIN OBJECTBUCKET ROLEBINDING
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-object-bucket
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-object-bucket
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
# OLM: END OBJECTBUCKET ROLEBINDING
|
|
# OLM: BEGIN OPERATOR ROLE
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-admission-controller
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-admission-controller-role
|
|
rules:
|
|
- apiGroups: ["ceph.rook.io"]
|
|
resources: ["*"]
|
|
verbs: ["get", "watch", "list"]
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-admission-controller-rolebinding
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-admission-controller
|
|
apiGroup: ""
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: rook-ceph-admission-controller-role
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
# The cluster role for managing all the cluster-specific resources in a namespace
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: rook-ceph-cluster-mgmt
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
- apps
|
|
- extensions
|
|
resources:
|
|
- secrets
|
|
- pods
|
|
- pods/log
|
|
- services
|
|
- configmaps
|
|
- deployments
|
|
- daemonsets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- patch
|
|
- create
|
|
- update
|
|
- delete
|
|
---
|
|
# The role for the operator to manage resources in its own namespace
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- configmaps
|
|
- services
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- patch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- apps
|
|
- extensions
|
|
resources:
|
|
- daemonsets
|
|
- statefulsets
|
|
- deployments
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- batch
|
|
resources:
|
|
- cronjobs
|
|
verbs:
|
|
- delete
|
|
---
|
|
# The cluster role for managing the Rook CRDs
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: rook-ceph-global
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# Pod access is needed for fencing
|
|
- pods
|
|
# Node access is needed for determining nodes where mons should run
|
|
- nodes
|
|
- nodes/proxy
|
|
- services
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
# PVs and PVCs are managed by the Rook provisioner
|
|
- persistentvolumes
|
|
- persistentvolumeclaims
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- patch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- storage.k8s.io
|
|
resources:
|
|
- storageclasses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- batch
|
|
resources:
|
|
- jobs
|
|
- cronjobs
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- ceph.rook.io
|
|
resources:
|
|
- "*"
|
|
verbs:
|
|
- "*"
|
|
- apiGroups:
|
|
- rook.io
|
|
resources:
|
|
- "*"
|
|
verbs:
|
|
- "*"
|
|
- apiGroups:
|
|
- policy
|
|
- apps
|
|
- extensions
|
|
resources:
|
|
# This is for the clusterdisruption controller
|
|
- poddisruptionbudgets
|
|
# This is for both clusterdisruption and nodedrain controllers
|
|
- deployments
|
|
- replicasets
|
|
verbs:
|
|
- "*"
|
|
- apiGroups:
|
|
- healthchecking.openshift.io
|
|
resources:
|
|
- machinedisruptionbudgets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- machine.openshift.io
|
|
resources:
|
|
- machines
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- storage.k8s.io
|
|
resources:
|
|
- csidrivers
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- k8s.cni.cncf.io
|
|
resources:
|
|
- network-attachment-definitions
|
|
verbs:
|
|
- get
|
|
---
|
|
# Aspects of ceph-mgr that require cluster-wide access
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-mgr-cluster
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
- nodes
|
|
- nodes/proxy
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
- list
|
|
- get
|
|
- watch
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-object-bucket
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
verbs:
|
|
- "*"
|
|
resources:
|
|
- secrets
|
|
- configmaps
|
|
- apiGroups:
|
|
- storage.k8s.io
|
|
resources:
|
|
- storageclasses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- "objectbucket.io"
|
|
verbs:
|
|
- "*"
|
|
resources:
|
|
- "*"
|
|
# OLM: END OPERATOR ROLE
|
|
# OLM: BEGIN SERVICE ACCOUNT SYSTEM
|
|
---
|
|
# The rook system service account used by the operator, agent, and discovery pods
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
# imagePullSecrets:
|
|
# - name: my-registry-secret
|
|
|
|
# OLM: END SERVICE ACCOUNT SYSTEM
|
|
# OLM: BEGIN OPERATOR ROLEBINDING
|
|
---
|
|
# Grant the operator, agent, and discovery agents access to resources in the namespace
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-system
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
# Grant the rook system daemons cluster-wide access to manage the Rook CRDs, PVCs, and storage classes
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-global
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-global
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
# OLM: END OPERATOR ROLEBINDING
|
|
#################################################################################################################
|
|
# Beginning of cluster-specific resources. The example will assume the cluster will be created in the "rook-ceph"
|
|
# namespace. If you want to create the cluster in a different namespace, you will need to modify these roles
|
|
# and bindings accordingly.
|
|
#################################################################################################################
|
|
# Service account for the Ceph OSDs. Must exist and cannot be renamed.
|
|
# OLM: BEGIN SERVICE ACCOUNT OSD
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph # namespace:cluster
|
|
# imagePullSecrets:
|
|
# - name: my-registry-secret
|
|
|
|
# OLM: END SERVICE ACCOUNT OSD
|
|
# OLM: BEGIN SERVICE ACCOUNT MGR
|
|
---
|
|
# Service account for the Ceph Mgr. Must exist and cannot be renamed.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph # namespace:cluster
|
|
# imagePullSecrets:
|
|
# - name: my-registry-secret
|
|
|
|
# OLM: END SERVICE ACCOUNT MGR
|
|
# OLM: BEGIN CMD REPORTER SERVICE ACCOUNT
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph # namespace:cluster
|
|
# OLM: END CMD REPORTER SERVICE ACCOUNT
|
|
# OLM: BEGIN CLUSTER ROLE
|
|
---
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph # namespace:cluster
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
|
- apiGroups: ["ceph.rook.io"]
|
|
resources: ["cephclusters", "cephclusters/finalizers"]
|
|
verbs: ["get", "list", "create", "update", "delete"]
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-osd
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
---
|
|
# Aspects of ceph-mgr that require access to the system namespace
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-mgr-system
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
---
|
|
# Aspects of ceph-mgr that operate within the cluster's namespace
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph # namespace:cluster
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- services
|
|
- pods/log
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- batch
|
|
resources:
|
|
- jobs
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- ceph.rook.io
|
|
resources:
|
|
- "*"
|
|
verbs:
|
|
- "*"
|
|
# OLM: END CLUSTER ROLE
|
|
# OLM: BEGIN CMD REPORTER ROLE
|
|
---
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph # namespace:cluster
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
# OLM: END CMD REPORTER ROLE
|
|
# OLM: BEGIN CLUSTER ROLEBINDING
|
|
---
|
|
# Allow the operator to create resources in this cluster's namespace
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-cluster-mgmt
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-cluster-mgmt
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
# Allow the osd pods in this namespace to work with configmaps
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-osd
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph # namespace:cluster
|
|
---
|
|
# Allow the ceph mgr to access the cluster-specific resources necessary for the mgr modules
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-mgr
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph # namespace:cluster
|
|
---
|
|
# Allow the ceph mgr to access the rook system resources necessary for the mgr modules
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-mgr-system
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-mgr-system
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph # namespace:cluster
|
|
---
|
|
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-mgr-cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-mgr-cluster
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph # namespace:cluster
|
|
|
|
---
|
|
# Allow the ceph osd to access cluster-wide resources necessary for determining their topology location
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-osd
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-osd
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph # namespace:cluster
|
|
|
|
# OLM: END CLUSTER ROLEBINDING
|
|
# OLM: BEGIN CMD REPORTER ROLEBINDING
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-cmd-reporter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph # namespace:cluster
|
|
# OLM: END CMD REPORTER ROLEBINDING
|
|
#################################################################################################################
|
|
# Beginning of pod security policy resources. The example will assume the cluster will be created in the
|
|
# "rook-ceph" namespace. If you want to create the cluster in a different namespace, you will need to modify
|
|
# the roles and bindings accordingly.
|
|
#################################################################################################################
|
|
# OLM: BEGIN CLUSTER POD SECURITY POLICY
|
|
---
|
|
apiVersion: policy/v1beta1
|
|
kind: PodSecurityPolicy
|
|
metadata:
|
|
# Note: Kubernetes matches PSPs to deployments alphabetically. In some environments, this PSP may
|
|
# need to be renamed with a value that will match before others.
|
|
name: 00-rook-privileged
|
|
annotations:
|
|
seccomp.security.alpha.kubernetes.io/allowedProfileNames: "runtime/default"
|
|
seccomp.security.alpha.kubernetes.io/defaultProfileName: "runtime/default"
|
|
spec:
|
|
privileged: true
|
|
allowedCapabilities:
|
|
# required by CSI
|
|
- SYS_ADMIN
|
|
# fsGroup - the flexVolume agent has fsGroup capabilities and could potentially be any group
|
|
fsGroup:
|
|
rule: RunAsAny
|
|
# runAsUser, supplementalGroups - Rook needs to run some pods as root
|
|
# Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
|
|
runAsUser:
|
|
rule: RunAsAny
|
|
supplementalGroups:
|
|
rule: RunAsAny
|
|
# seLinux - seLinux context is unknown ahead of time; set if this is well-known
|
|
seLinux:
|
|
rule: RunAsAny
|
|
volumes:
|
|
# recommended minimum set
|
|
- configMap
|
|
- downwardAPI
|
|
- emptyDir
|
|
- persistentVolumeClaim
|
|
- secret
|
|
- projected
|
|
# required for Rook
|
|
- hostPath
|
|
- flexVolume
|
|
# allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
|
|
# allowedHostPaths:
|
|
# - pathPrefix: "/run/udev" # for OSD prep
|
|
# readOnly: false
|
|
# - pathPrefix: "/dev" # for OSD prep
|
|
# readOnly: false
|
|
# - pathPrefix: "/var/lib/rook" # or whatever the dataDirHostPath value is set to
|
|
# readOnly: false
|
|
# Ceph requires host IPC for setting up encrypted devices
|
|
hostIPC: true
|
|
# Ceph OSDs need to share the same PID namespace
|
|
hostPID: true
|
|
# hostNetwork can be set to 'false' if host networking isn't used
|
|
hostNetwork: true
|
|
hostPorts:
|
|
# Ceph messenger protocol v1
|
|
- min: 6789
|
|
max: 6790 # <- support old default port
|
|
# Ceph messenger protocol v2
|
|
- min: 3300
|
|
max: 3300
|
|
# Ceph RADOS ports for OSDs, MDSes
|
|
- min: 6800
|
|
max: 7300
|
|
# # Ceph dashboard port HTTP (not recommended)
|
|
# - min: 7000
|
|
# max: 7000
|
|
# Ceph dashboard port HTTPS
|
|
- min: 8443
|
|
max: 8443
|
|
# Ceph mgr Prometheus Metrics
|
|
- min: 9283
|
|
max: 9283
|
|
# OLM: END CLUSTER POD SECURITY POLICY
|
|
# OLM: BEGIN POD SECURITY POLICY BINDINGS
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: "psp:rook"
|
|
rules:
|
|
- apiGroups:
|
|
- policy
|
|
resources:
|
|
- podsecuritypolicies
|
|
resourceNames:
|
|
- 00-rook-privileged
|
|
verbs:
|
|
- use
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: rook-ceph-system-psp
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: "psp:rook"
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: rook-ceph-default-psp
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: psp:rook
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: default
|
|
namespace: rook-ceph # namespace:cluster
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: rook-ceph-osd-psp
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: psp:rook
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph # namespace:cluster
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: rook-ceph-mgr-psp
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: psp:rook
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph # namespace:cluster
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: rook-ceph-cmd-reporter-psp
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: psp:rook
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph # namespace:cluster
|
|
# OLM: END CLUSTER POD SECURITY POLICY BINDINGS
|
|
# OLM: BEGIN CSI CEPHFS SERVICE ACCOUNT
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-csi-cephfs-plugin-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-csi-cephfs-provisioner-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
# OLM: END CSI CEPHFS SERVICE ACCOUNT
|
|
# OLM: BEGIN CSI CEPHFS ROLE
|
|
---
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: cephfs-external-provisioner-cfg
|
|
namespace: rook-ceph # namespace:operator
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["endpoints"]
|
|
verbs: ["get", "watch", "list", "delete", "update", "create"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list", "create", "delete"]
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "watch", "list", "delete", "update", "create"]
|
|
# OLM: END CSI CEPHFS ROLE
|
|
# OLM: BEGIN CSI CEPHFS ROLEBINDING
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: cephfs-csi-provisioner-role-cfg
|
|
namespace: rook-ceph # namespace:operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-cephfs-provisioner-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
kind: Role
|
|
name: cephfs-external-provisioner-cfg
|
|
apiGroup: rbac.authorization.k8s.io
|
|
# OLM: END CSI CEPHFS ROLEBINDING
|
|
# OLM: BEGIN CSI CEPHFS CLUSTER ROLE
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: cephfs-csi-nodeplugin
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "list", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumes"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["volumeattachments"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list"]
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: cephfs-external-provisioner-runner
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumes"]
|
|
verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumeclaims"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["storageclasses"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["list", "watch", "create", "update", "patch"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshots"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshotcontents"]
|
|
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshotclasses"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshotcontents/status"]
|
|
verbs: ["update"]
|
|
- apiGroups: ["apiextensions.k8s.io"]
|
|
resources: ["customresourcedefinitions"]
|
|
verbs: ["create", "list", "watch", "delete", "get", "update"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshots/status"]
|
|
verbs: ["update"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["volumeattachments"]
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["volumeattachments/status"]
|
|
verbs: ["patch"]
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumeclaims/status"]
|
|
verbs: ["update", "patch"]
|
|
# OLM: END CSI CEPHFS CLUSTER ROLE
|
|
# OLM: BEGIN CSI CEPHFS CLUSTER ROLEBINDING
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: rook-csi-cephfs-plugin-sa-psp
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: "psp:rook"
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-cephfs-plugin-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: rook-csi-cephfs-provisioner-sa-psp
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: "psp:rook"
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-cephfs-provisioner-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: cephfs-csi-nodeplugin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-cephfs-plugin-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: cephfs-csi-nodeplugin
|
|
apiGroup: rbac.authorization.k8s.io
|
|
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: cephfs-csi-provisioner-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-cephfs-provisioner-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: cephfs-external-provisioner-runner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
# OLM: END CSI CEPHFS CLUSTER ROLEBINDING
|
|
# OLM: BEGIN CSI RBD SERVICE ACCOUNT
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-csi-rbd-plugin-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-csi-rbd-provisioner-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
# OLM: END CSI RBD SERVICE ACCOUNT
|
|
# OLM: BEGIN CSI RBD ROLE
|
|
---
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rbd-external-provisioner-cfg
|
|
namespace: rook-ceph # namespace:operator
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["endpoints"]
|
|
verbs: ["get", "watch", "list", "delete", "update", "create"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "watch", "list", "delete", "update", "create"]
|
|
# OLM: END CSI RBD ROLE
|
|
# OLM: BEGIN CSI RBD ROLEBINDING
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rbd-csi-provisioner-role-cfg
|
|
namespace: rook-ceph # namespace:operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-rbd-provisioner-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
kind: Role
|
|
name: rbd-external-provisioner-cfg
|
|
apiGroup: rbac.authorization.k8s.io
|
|
# OLM: END CSI RBD ROLEBINDING
|
|
# OLM: BEGIN CSI RBD CLUSTER ROLE
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rbd-csi-nodeplugin
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "list", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumes"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["volumeattachments"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list"]
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rbd-external-provisioner-runner
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumes"]
|
|
verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumeclaims"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["volumeattachments"]
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["volumeattachments/status"]
|
|
verbs: ["patch"]
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["storageclasses"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["list", "watch", "create", "update", "patch"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshots"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshotcontents"]
|
|
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshotclasses"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshotcontents/status"]
|
|
verbs: ["update"]
|
|
- apiGroups: ["apiextensions.k8s.io"]
|
|
resources: ["customresourcedefinitions"]
|
|
verbs: ["create", "list", "watch", "delete", "get", "update"]
|
|
- apiGroups: ["snapshot.storage.k8s.io"]
|
|
resources: ["volumesnapshots/status"]
|
|
verbs: ["update"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumeclaims/status"]
|
|
verbs: ["update", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["replication.storage.openshift.io"]
|
|
resources: ["volumereplications", "volumereplicationclasses"]
|
|
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
|
|
- apiGroups: ["replication.storage.openshift.io"]
|
|
resources: ["volumereplications/finalizers"]
|
|
verbs: ["update"]
|
|
- apiGroups: ["replication.storage.openshift.io"]
|
|
resources: ["volumereplications/status"]
|
|
verbs: ["get", "patch", "update"]
|
|
- apiGroups: ["replication.storage.openshift.io"]
|
|
resources: ["volumereplicationclasses/status"]
|
|
verbs: ["get"]
|
|
# OLM: END CSI RBD CLUSTER ROLE
|
|
# OLM: BEGIN CSI RBD CLUSTER ROLEBINDING
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: rook-csi-rbd-plugin-sa-psp
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: "psp:rook"
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-rbd-plugin-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: rook-csi-rbd-provisioner-sa-psp
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: "psp:rook"
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-rbd-provisioner-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rbd-csi-nodeplugin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-rbd-plugin-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: rbd-csi-nodeplugin
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rbd-csi-provisioner-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-csi-rbd-provisioner-sa
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: rbd-external-provisioner-runner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
# OLM: END CSI RBD CLUSTER ROLEBINDING
|