CSI: Add CSI clusterrole for upgrade testing

Add required clusterrole for CSI to work when rook
upgraded from 1.2 to 1.3

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>

tests/framework/installer/ceph_manifests_v1.3.go

@@ -45,8 +45,91 @@ func (m *CephManifestsV1_3) RookImage() string {
 // UpgradeToV1_3 performs the steps necessary to upgrade a Rook v1.1 cluster to v1.2. It does not
 // verify the upgrade but merely starts the upgrade process.
 func (m *CephManifestsV1_3) UpgradeToV1_3() {
-	// no special manifest operations (apply, create, delete) yet
+	require.NoError(m.T(), m.K8sh.ResourceOperation("apply", m.applyManifest()))
 
 	require.NoError(m.T(),
 		m.K8sh.SetDeploymentVersion(m.SystemNamespace, m.OperatorContainer, m.OperatorContainer, version1_3))
 }
+
+func (m *CephManifestsV1_3) applyManifest() string {
+	return `
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+   name: cephfs-external-provisioner-runner-rules
+   labels:
+      rbac.ceph.rook.io/aggregate-to-cephfs-external-provisioner-runner: "true"
+rules:
+   - apiGroups: [""]
+     resources: ["secrets"]
+     verbs: ["get", "list"]
+   - apiGroups: [""]
+     resources: ["persistentvolumes"]
+     verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+   - apiGroups: [""]
+     resources: ["persistentvolumeclaims"]
+     verbs: ["get", "list", "watch", "update"]
+   - apiGroups: ["storage.k8s.io"]
+     resources: ["storageclasses"]
+     verbs: ["get", "list", "watch"]
+   - apiGroups: [""]
+     resources: ["events"]
+     verbs: ["list", "watch", "create", "update", "patch"]
+   - apiGroups: ["storage.k8s.io"]
+     resources: ["volumeattachments"]
+     verbs: ["get", "list", "watch", "update", "patch"]
+   - apiGroups: [""]
+     resources: ["nodes"]
+     verbs: ["get", "list", "watch"]
+   - apiGroups: [""]
+     resources: ["persistentvolumeclaims/status"]
+     verbs: ["update", "patch"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+   name: rbd-external-provisioner-runner-rules
+   labels:
+      rbac.ceph.rook.io/aggregate-to-rbd-external-provisioner-runner: "true"
+rules:
+   - apiGroups: [""]
+     resources: ["secrets"]
+     verbs: ["get", "list"]
+   - apiGroups: [""]
+     resources: ["persistentvolumes"]
+     verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+   - apiGroups: [""]
+     resources: ["persistentvolumeclaims"]
+     verbs: ["get", "list", "watch", "update"]
+   - apiGroups: ["storage.k8s.io"]
+     resources: ["volumeattachments"]
+     verbs: ["get", "list", "watch", "update", "patch"]
+   - apiGroups: [""]
+     resources: ["nodes"]
+     verbs: ["get", "list", "watch"]
+   - apiGroups: ["storage.k8s.io"]
+     resources: ["storageclasses"]
+     verbs: ["get", "list", "watch"]
+   - apiGroups: [""]
+     resources: ["events"]
+     verbs: ["list", "watch", "create", "update", "patch"]
+   - apiGroups: ["snapshot.storage.k8s.io"]
+     resources: ["volumesnapshots"]
+     verbs: ["get", "list", "watch", "update"]
+   - apiGroups: ["snapshot.storage.k8s.io"]
+     resources: ["volumesnapshotcontents"]
+     verbs: ["create", "get", "list", "watch", "update", "delete"]
+   - apiGroups: ["snapshot.storage.k8s.io"]
+     resources: ["volumesnapshotclasses"]
+     verbs: ["get", "list", "watch"]
+   - apiGroups: ["apiextensions.k8s.io"]
+     resources: ["customresourcedefinitions"]
+     verbs: ["create", "list", "watch", "delete", "get", "update"]
+   - apiGroups: ["snapshot.storage.k8s.io"]
+     resources: ["volumesnapshots/status"]
+     verbs: ["update"]
+   - apiGroups: [""]
+     resources: ["persistentvolumeclaims/status"]
+     verbs: ["update", "patch"]
+`
+}