security: remove nodes/proxy rbac grants

It has only been used by the flex driver which is long gone.

This removes the nodes/proxy RBAC grant from the helm chart, the example
YAMl and the security design docs.

Signed-off-by: Tobias Florek <me@ibotty.net>
(cherry picked from commit db814dcd4b)

deploy/charts/rook-ceph/templates/clusterrole.yaml

@@ -82,7 +82,6 @@ rules:
       - pods
       # Node access is needed for determining nodes where mons should run
       - nodes
-      - nodes/proxy
       # Rook watches secrets which it uses to configure access to external resources.
       # e.g., external Ceph cluster or object store
       - secrets
@@ -281,7 +280,6 @@ rules:
     resources:
       - configmaps
       - nodes
-      - nodes/proxy
       - persistentvolumes
     verbs:
       - get

deploy/examples/common.yaml

@@ -303,7 +303,6 @@ rules:
       - pods
       # Node access is needed for determining nodes where mons should run
       - nodes
-      - nodes/proxy
       # Rook watches secrets which it uses to configure access to external resources.
       # e.g., external Ceph cluster or object store
       - secrets
@@ -505,7 +504,6 @@ rules:
     resources:
       - configmaps
       - nodes
-      - nodes/proxy
       - persistentvolumes
     verbs:
       - get

design/ceph/security-model.md

@@ -30,7 +30,7 @@ metadata:
   name: rook-operator
 rules:
 - apiGroups: [""]
-  resources: ["namespaces", "serviceaccounts", "secrets", "pods", "services", "nodes", "nodes/proxy", "configmaps", "events", "persistentvolumes", "persistentvolumeclaims"]
+  resources: ["namespaces", "serviceaccounts", "secrets", "pods", "services", "nodes", "configmaps", "events", "persistentvolumes", "persistentvolumeclaims"]
   verbs: [ "get", "list", "watch", "patch", "create", "update", "delete" ]
 - apiGroups: ["extensions"]
   resources: ["thirdpartyresources", "deployments", "daemonsets", "replicasets"]
@@ -79,7 +79,7 @@ metadata:
   name: rook-ceph-agent
 rules:
 - apiGroups: [""]
-  resources: ["pods", "secrets", "configmaps", "persistentvolumes", "nodes", "nodes/proxy"]
+  resources: ["pods", "secrets", "configmaps", "persistentvolumes", "nodes"]
   verbs: [ "get", "list" ]
 - apiGroups: ["storage.k8s.io"]
   resources: ["storageclasses"]