From 305d54bfbc9c85cdc8a6060c54c0681c474a12fd Mon Sep 17 00:00:00 2001 From: Tobias Florek Date: Wed, 28 Jan 2026 08:09:19 +0100 Subject: [PATCH] security: remove nodes/proxy rbac grants It has only been used by the flex driver which is long gone. This removes the nodes/proxy RBAC grant from the helm chart, the example YAMl and the security design docs. Signed-off-by: Tobias Florek (cherry picked from commit db814dcd4b652bbe14c84957a0a79b5b33de58cb) --- deploy/charts/rook-ceph/templates/clusterrole.yaml | 2 -- deploy/examples/common.yaml | 2 -- design/ceph/security-model.md | 4 ++-- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/deploy/charts/rook-ceph/templates/clusterrole.yaml b/deploy/charts/rook-ceph/templates/clusterrole.yaml index d1bf92fc9..1781f2965 100644 --- a/deploy/charts/rook-ceph/templates/clusterrole.yaml +++ b/deploy/charts/rook-ceph/templates/clusterrole.yaml @@ -82,7 +82,6 @@ rules: - pods # Node access is needed for determining nodes where mons should run - nodes - - nodes/proxy # Rook watches secrets which it uses to configure access to external resources. # e.g., external Ceph cluster or object store - secrets @@ -281,7 +280,6 @@ rules: resources: - configmaps - nodes - - nodes/proxy - persistentvolumes verbs: - get diff --git a/deploy/examples/common.yaml b/deploy/examples/common.yaml index b33e5693c..a4ceb0517 100644 --- a/deploy/examples/common.yaml +++ b/deploy/examples/common.yaml @@ -303,7 +303,6 @@ rules: - pods # Node access is needed for determining nodes where mons should run - nodes - - nodes/proxy # Rook watches secrets which it uses to configure access to external resources. # e.g., external Ceph cluster or object store - secrets @@ -505,7 +504,6 @@ rules: resources: - configmaps - nodes - - nodes/proxy - persistentvolumes verbs: - get diff --git a/design/ceph/security-model.md b/design/ceph/security-model.md index e97030b19..8444aa838 100644 --- a/design/ceph/security-model.md +++ b/design/ceph/security-model.md @@ -30,7 +30,7 @@ metadata: name: rook-operator rules: - apiGroups: [""] - resources: ["namespaces", "serviceaccounts", "secrets", "pods", "services", "nodes", "nodes/proxy", "configmaps", "events", "persistentvolumes", "persistentvolumeclaims"] + resources: ["namespaces", "serviceaccounts", "secrets", "pods", "services", "nodes", "configmaps", "events", "persistentvolumes", "persistentvolumeclaims"] verbs: [ "get", "list", "watch", "patch", "create", "update", "delete" ] - apiGroups: ["extensions"] resources: ["thirdpartyresources", "deployments", "daemonsets", "replicasets"] @@ -79,7 +79,7 @@ metadata: name: rook-ceph-agent rules: - apiGroups: [""] - resources: ["pods", "secrets", "configmaps", "persistentvolumes", "nodes", "nodes/proxy"] + resources: ["pods", "secrets", "configmaps", "persistentvolumes", "nodes"] verbs: [ "get", "list" ] - apiGroups: ["storage.k8s.io"] resources: ["storageclasses"]