From f635d96ae9931485f071bb5abbef09e56e5b3ca0 Mon Sep 17 00:00:00 2001 From: fullstackjam Date: Fri, 26 Sep 2025 03:41:26 +0800 Subject: [PATCH 1/2] helm: add missing labels to RBAC resources to prevent ArgoCD drift This PR addresses ArgoCD drift detection issues by adding consistent metadata labels to RBAC resources in Rook Ceph Helm charts. The problem occurs because many RBAC resources lack metadata labels, causing ArgoCD to interpret them as 'labels: null' and report continuous drift. Changes made: - Added consistent labels to all RBAC templates in rook-ceph and library charts - Created _recommended-labels.tpl template for standardized labeling - Removed app.kubernetes.io/component label per consideRatio feedback to avoid scope creep - Suppressed Helm-specific labels (version, instance, managed-by, created-by, chart) from static RBAC files - Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml Labels added to RBAC resources: - operator: rook - storage-backend: ceph - app.kubernetes.io/name: rook-ceph - app.kubernetes.io/part-of: rook-ceph-operator Impact: - Resolves ArgoCD 'OutOfSync' issues for Rook RBAC resources - Improves resource identification and management - Provides consistent labeling across all Rook Helm charts - No functional changes to RBAC permissions - Focuses on essential labels to avoid over-engineering This addresses review feedback from travisn and consideRatio to maintain scope and ensure static RBAC files only contain meaningful labels. Signed-off-by: fullstackjam --- build/rbac/keep-rbac-yaml.sh | 2 + .../templates/_cluster-clusterrolebinding.tpl | 4 + .../library/templates/_cluster-monitoring.tpl | 8 + .../library/templates/_cluster-role.tpl | 8 + .../templates/_cluster-rolebinding.tpl | 12 ++ .../templates/_cluster-serviceaccount.tpl | 13 +- .../library/templates/_recommended-labels.tpl | 8 +- .../rook-ceph/templates/aggregate-roles.yaml | 2 + .../rook-ceph/templates/clusterrole.yaml | 26 ++- .../templates/clusterrolebinding.yaml | 18 +- deploy/charts/rook-ceph/templates/role.yaml | 8 +- .../rook-ceph/templates/rolebinding.yaml | 8 +- .../rook-ceph/templates/serviceaccount.yaml | 2 - deploy/examples/common.yaml | 162 ++++++++++++++++++ deploy/examples/csi/nfs/rbac.yaml | 16 ++ 15 files changed, 262 insertions(+), 35 deletions(-) diff --git a/build/rbac/keep-rbac-yaml.sh b/build/rbac/keep-rbac-yaml.sh index 58477e096..1f46df674 100755 --- a/build/rbac/keep-rbac-yaml.sh +++ b/build/rbac/keep-rbac-yaml.sh @@ -29,6 +29,8 @@ $YQ eval ' $YQ eval 'del(.metadata.labels."helm.sh/chart")' - | # remove the 'helm.sh/chart' label that only applies to Helm-managed resources $YQ eval 'del(.metadata.labels."app.kubernetes.io/managed-by")' - | # remove the 'labels.app.kubernetes.io/managed-by' label that only applies to Helm-managed resources $YQ eval 'del(.metadata.labels."app.kubernetes.io/created-by")' - | # remove the 'app.kubernetes.io/created-by' label that only applies to Helm-managed resources +$YQ eval 'del(.metadata.labels."app.kubernetes.io/version")' - | # remove the version label that contains library chart version instead of actual rook version +$YQ eval 'del(.metadata.labels."app.kubernetes.io/instance")' - | # remove the instance label that doesn't make sense in static files sed '/^$/d' | # remove empty lines caused by yq's display of header/footer comments sed '/^# Source: /d' | # helm adds '# Source: ' comments atop of each yaml doc. Strip these $YQ eval --split-exp '.kind + " " + .metadata.name + " "' - # split into files by .yaml diff --git a/deploy/charts/library/templates/_cluster-clusterrolebinding.tpl b/deploy/charts/library/templates/_cluster-clusterrolebinding.tpl index c40b81ad0..1e47dc3cc 100644 --- a/deploy/charts/library/templates/_cluster-clusterrolebinding.tpl +++ b/deploy/charts/library/templates/_cluster-clusterrolebinding.tpl @@ -8,6 +8,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-cluster{{ include "library.suffix-cluster-namespace" . }} + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -22,6 +24,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd{{ include "library.suffix-cluster-namespace" . }} + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole diff --git a/deploy/charts/library/templates/_cluster-monitoring.tpl b/deploy/charts/library/templates/_cluster-monitoring.tpl index 15ce502fa..e267a9c88 100644 --- a/deploy/charts/library/templates/_cluster-monitoring.tpl +++ b/deploy/charts/library/templates/_cluster-monitoring.tpl @@ -10,6 +10,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-monitoring namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: - "monitoring.coreos.com" @@ -29,6 +31,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-monitoring-mgr namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: - monitoring.coreos.com @@ -49,6 +53,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-monitoring namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -64,6 +70,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-monitoring-mgr namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/deploy/charts/library/templates/_cluster-role.tpl b/deploy/charts/library/templates/_cluster-role.tpl index 49628c225..14b2e979a 100644 --- a/deploy/charts/library/templates/_cluster-role.tpl +++ b/deploy/charts/library/templates/_cluster-role.tpl @@ -8,6 +8,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: # this is needed for rook's "key-management" CLI to fetch the vault token from the secret when # validating the connection details and for key rotation operations. @@ -27,6 +29,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: - "" @@ -100,6 +104,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cmd-reporter namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: - "" @@ -120,6 +126,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-purge-osd namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: [""] resources: ["configmaps"] diff --git a/deploy/charts/library/templates/_cluster-rolebinding.tpl b/deploy/charts/library/templates/_cluster-rolebinding.tpl index 5154bb73d..fe3c3abc8 100644 --- a/deploy/charts/library/templates/_cluster-rolebinding.tpl +++ b/deploy/charts/library/templates/_cluster-rolebinding.tpl @@ -9,6 +9,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cluster-mgmt namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -24,6 +26,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -39,6 +43,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -54,6 +60,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-system{{ include "library.suffix-cluster-namespace" . }} namespace: {{ .Values.operatorNamespace | default .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -68,6 +76,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cmd-reporter namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -83,6 +93,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-purge-osd namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/deploy/charts/library/templates/_cluster-serviceaccount.tpl b/deploy/charts/library/templates/_cluster-serviceaccount.tpl index b9483392b..02bd17f87 100644 --- a/deploy/charts/library/templates/_cluster-serviceaccount.tpl +++ b/deploy/charts/library/templates/_cluster-serviceaccount.tpl @@ -10,8 +10,6 @@ metadata: name: rook-ceph-osd namespace: {{ .Release.Namespace }} # namespace:cluster labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- @@ -22,8 +20,6 @@ metadata: name: rook-ceph-mgr namespace: {{ .Release.Namespace }} # namespace:cluster labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- @@ -34,8 +30,6 @@ metadata: name: rook-ceph-cmd-reporter namespace: {{ .Release.Namespace }} # namespace:cluster labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- @@ -45,6 +39,8 @@ apiVersion: v1 metadata: name: rook-ceph-purge-osd namespace: {{ .Release.Namespace }} # namespace:cluster + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for RGW server @@ -54,8 +50,6 @@ metadata: name: rook-ceph-rgw namespace: {{ .Release.Namespace }} # namespace:cluster labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- @@ -66,7 +60,6 @@ metadata: name: rook-ceph-default namespace: {{ .Release.Namespace }} # namespace:cluster labels: - operator: rook - storage-backend: ceph + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/deploy/charts/library/templates/_recommended-labels.tpl b/deploy/charts/library/templates/_recommended-labels.tpl index 6b7457f11..ad12deae8 100644 --- a/deploy/charts/library/templates/_recommended-labels.tpl +++ b/deploy/charts/library/templates/_recommended-labels.tpl @@ -1,7 +1,13 @@ {{- /* - Common labels + Modern recommended labels following Kubernetes best practices + Based on: https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ */}} {{- define "library.rook-ceph.labels" -}} +operator: rook +storage-backend: ceph +app.kubernetes.io/name: rook-ceph +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/version: {{ .Chart.AppVersion | default .Chart.Version }} app.kubernetes.io/part-of: rook-ceph-operator app.kubernetes.io/managed-by: {{ .Release.Service }} app.kubernetes.io/created-by: helm diff --git a/deploy/charts/rook-ceph/templates/aggregate-roles.yaml b/deploy/charts/rook-ceph/templates/aggregate-roles.yaml index cb6ddeea6..6dd4f994b 100644 --- a/deploy/charts/rook-ceph/templates/aggregate-roles.yaml +++ b/deploy/charts/rook-ceph/templates/aggregate-roles.yaml @@ -5,6 +5,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-obc-view labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rbac.authorization.k8s.io/aggregate-to-view: "true" rules: - apiGroups: @@ -21,6 +22,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-obc-edit labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rbac.authorization.k8s.io/aggregate-to-edit: "true" rules: - apiGroups: diff --git a/deploy/charts/rook-ceph/templates/clusterrole.yaml b/deploy/charts/rook-ceph/templates/clusterrole.yaml index cf125ee56..d1bf92fc9 100644 --- a/deploy/charts/rook-ceph/templates/clusterrole.yaml +++ b/deploy/charts/rook-ceph/templates/clusterrole.yaml @@ -5,8 +5,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-system labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: # Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint. @@ -44,8 +42,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cluster-mgmt labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: @@ -77,8 +73,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-global labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: @@ -280,8 +274,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-cluster labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: @@ -319,6 +311,8 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-system + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: - "" @@ -337,8 +331,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-object-bucket labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: [""] @@ -396,6 +388,8 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: - "" @@ -409,6 +403,8 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-csi-nodeplugin + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: [""] resources: ["nodes"] @@ -431,6 +427,8 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: ceph-nfs-external-provisioner-runner + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: [""] resources: ["persistentvolumes"] @@ -485,8 +483,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: ceph-nfs-csi-nodeplugin labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: [""] @@ -498,6 +494,8 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-external-provisioner-runner + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: [""] resources: ["secrets"] @@ -568,8 +566,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-nodeplugin labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: [""] @@ -601,6 +597,8 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-external-provisioner-runner + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: [""] resources: ["secrets"] diff --git a/deploy/charts/rook-ceph/templates/clusterrolebinding.yaml b/deploy/charts/rook-ceph/templates/clusterrolebinding.yaml index d5b0b814a..360b5ba41 100644 --- a/deploy/charts/rook-ceph/templates/clusterrolebinding.yaml +++ b/deploy/charts/rook-ceph/templates/clusterrolebinding.yaml @@ -5,8 +5,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-system labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io @@ -23,8 +21,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-global labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io @@ -40,6 +36,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-object-bucket + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -53,6 +51,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-nodeplugin + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-rbd-plugin-sa @@ -66,6 +66,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-csi-provisioner-role + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-cephfs-provisioner-sa @@ -81,6 +83,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-csi-nodeplugin-role + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-cephfs-plugin-sa @@ -95,6 +99,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: ceph-nfs-csi-provisioner-role + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-nfs-provisioner-sa @@ -110,6 +116,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: ceph-nfs-csi-nodeplugin-role + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-nfs-plugin-sa @@ -124,6 +132,8 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-provisioner-role + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-rbd-provisioner-sa diff --git a/deploy/charts/rook-ceph/templates/role.yaml b/deploy/charts/rook-ceph/templates/role.yaml index 993760804..ab0997c4b 100644 --- a/deploy/charts/rook-ceph/templates/role.yaml +++ b/deploy/charts/rook-ceph/templates/role.yaml @@ -7,8 +7,6 @@ metadata: name: rook-ceph-system namespace: {{ .Release.Namespace }} # namespace:operator labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: @@ -68,6 +66,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-external-provisioner-cfg namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: ["coordination.k8s.io"] resources: ["leases"] @@ -93,6 +93,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-nodeplugin namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: ["csiaddons.openshift.io"] resources: ["csiaddonsnodes"] @@ -113,6 +115,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-external-provisioner-cfg namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} rules: - apiGroups: ["coordination.k8s.io"] resources: ["leases"] diff --git a/deploy/charts/rook-ceph/templates/rolebinding.yaml b/deploy/charts/rook-ceph/templates/rolebinding.yaml index 086ec7256..ae2dc54a4 100644 --- a/deploy/charts/rook-ceph/templates/rolebinding.yaml +++ b/deploy/charts/rook-ceph/templates/rolebinding.yaml @@ -7,8 +7,6 @@ metadata: name: rook-ceph-system namespace: {{ .Release.Namespace }} # namespace:operator labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io @@ -24,6 +22,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-csi-provisioner-role-cfg namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-cephfs-provisioner-sa @@ -39,6 +39,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-nodeplugin-role-cfg namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-rbd-plugin-sa @@ -54,6 +56,8 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-provisioner-role-cfg namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} subjects: - kind: ServiceAccount name: rook-csi-rbd-provisioner-sa diff --git a/deploy/charts/rook-ceph/templates/serviceaccount.yaml b/deploy/charts/rook-ceph/templates/serviceaccount.yaml index 545c7e3f2..2b5f7f265 100644 --- a/deploy/charts/rook-ceph/templates/serviceaccount.yaml +++ b/deploy/charts/rook-ceph/templates/serviceaccount.yaml @@ -6,8 +6,6 @@ metadata: name: rook-ceph-system namespace: {{ .Release.Namespace }} # namespace:operator labels: - operator: rook - storage-backend: ceph {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- diff --git a/deploy/examples/common.yaml b/deploy/examples/common.yaml index 811444606..49cd638b1 100644 --- a/deploy/examples/common.yaml +++ b/deploy/examples/common.yaml @@ -15,6 +15,11 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-csi-nodeplugin + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: [""] resources: ["nodes"] @@ -36,6 +41,11 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-external-provisioner-runner + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: [""] resources: ["secrets"] @@ -127,6 +137,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: [""] @@ -158,6 +169,11 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-external-provisioner-runner + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: [""] resources: ["secrets"] @@ -243,6 +259,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: @@ -276,6 +293,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: @@ -479,6 +497,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: @@ -516,6 +535,11 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-system + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: - "" @@ -536,6 +560,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: [""] @@ -593,6 +618,11 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: - "" @@ -609,6 +639,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator rules: # Most resources are represented by a string representation of their name, such as "pods", just as it appears in the URL for the relevant API endpoint. @@ -646,6 +677,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-csi-nodeplugin-role + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-cephfs-plugin-sa @@ -659,6 +695,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-csi-provisioner-role + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-cephfs-provisioner-sa @@ -690,6 +731,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-nodeplugin + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-rbd-plugin-sa @@ -703,6 +749,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-provisioner-role + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-rbd-provisioner-sa @@ -720,6 +771,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -735,6 +787,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -749,6 +806,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-object-bucket + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -763,6 +825,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -779,6 +846,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -794,6 +862,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-external-provisioner-cfg namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: ["coordination.k8s.io"] resources: ["leases"] @@ -816,6 +889,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-nodeplugin namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: ["csiaddons.openshift.io"] resources: ["csiaddonsnodes"] @@ -835,6 +913,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-external-provisioner-cfg namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: ["coordination.k8s.io"] resources: ["leases"] @@ -857,6 +940,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cmd-reporter namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: - "" @@ -877,6 +965,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: - "" @@ -950,6 +1043,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: # this is needed for rook's "key-management" CLI to fetch the vault token from the secret when # validating the connection details and for key rotation operations. @@ -969,6 +1067,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-purge-osd namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: [""] resources: ["configmaps"] @@ -992,6 +1095,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: @@ -1051,6 +1155,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cephfs-csi-provisioner-role-cfg namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-cephfs-provisioner-sa @@ -1065,6 +1174,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-nodeplugin-role-cfg namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-rbd-plugin-sa @@ -1079,6 +1193,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rbd-csi-provisioner-role-cfg namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-rbd-provisioner-sa @@ -1094,6 +1213,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cluster-mgmt namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -1108,6 +1232,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-cmd-reporter namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -1123,6 +1252,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -1138,6 +1272,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-mgr-system namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -1153,6 +1292,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-osd namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -1168,6 +1312,11 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rook-ceph-purge-osd namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -1186,6 +1335,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -1218,6 +1368,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret @@ -1231,6 +1382,8 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -1243,6 +1396,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret @@ -1256,6 +1410,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret @@ -1266,6 +1421,11 @@ apiVersion: v1 metadata: name: rook-ceph-purge-osd namespace: rook-ceph # namespace:cluster + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -1278,6 +1438,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret @@ -1291,6 +1452,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret diff --git a/deploy/examples/csi/nfs/rbac.yaml b/deploy/examples/csi/nfs/rbac.yaml index a7eedf88c..a4b1f9b8b 100644 --- a/deploy/examples/csi/nfs/rbac.yaml +++ b/deploy/examples/csi/nfs/rbac.yaml @@ -11,6 +11,7 @@ metadata: labels: operator: rook storage-backend: ceph + app.kubernetes.io/name: rook-ceph app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: [""] @@ -21,6 +22,11 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: ceph-nfs-external-provisioner-runner + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator rules: - apiGroups: [""] resources: ["persistentvolumes"] @@ -74,6 +80,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: ceph-nfs-csi-nodeplugin-role + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-nfs-plugin-sa @@ -87,6 +98,11 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: ceph-nfs-csi-provisioner-role + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator subjects: - kind: ServiceAccount name: rook-csi-nfs-provisioner-sa From 8656bd493c82b0f4d7b1a6b0ddaca99eefd8cf2b Mon Sep 17 00:00:00 2001 From: fullstackjam Date: Sun, 28 Sep 2025 01:02:08 +0800 Subject: [PATCH 2/2] helm: add missing labels to ConfigMap, SCC, and ServiceAccount resources Add consistent metadata labels to resources that were missing them: - configmap.yaml: Add labels to rook-ceph-operator-config ConfigMap - securityContextConstraints.yaml: Add labels to both rook-ceph and rook-ceph-csi SCCs - serviceaccount.yaml: Add labels to 6 CSI ServiceAccounts that were missing them All new labels use the unified library.rook-ceph.labels template for consistency. Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml to reflect the updated label definitions. This addresses reviewer feedback about missing labels in non-RBAC resources and ensures consistent labeling across all Rook Ceph Helm chart resources. Signed-off-by: fullstackjam --- .../charts/rook-ceph/templates/configmap.yaml | 2 ++ .../templates/securityContextConstraints.yaml | 4 ++++ .../rook-ceph/templates/serviceaccount.yaml | 12 +++++++++++ deploy/examples/common.yaml | 20 +++++++++++++++++++ deploy/examples/csi/nfs/rbac.yaml | 10 ++++++++++ 5 files changed, 48 insertions(+) diff --git a/deploy/charts/rook-ceph/templates/configmap.yaml b/deploy/charts/rook-ceph/templates/configmap.yaml index 4e5ac35fd..4b7a1f64a 100644 --- a/deploy/charts/rook-ceph/templates/configmap.yaml +++ b/deploy/charts/rook-ceph/templates/configmap.yaml @@ -6,6 +6,8 @@ apiVersion: v1 metadata: name: rook-ceph-operator-config namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} data: ROOK_LOG_LEVEL: {{ .Values.logLevel | quote }} ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: {{ .Values.cephCommandsTimeoutSeconds | quote }} diff --git a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml index c0b8d9774..2dc53b70d 100644 --- a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml +++ b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml @@ -6,6 +6,8 @@ kind: SecurityContextConstraints apiVersion: security.openshift.io/v1 metadata: name: rook-ceph + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} allowPrivilegedContainer: true allowHostDirVolumePlugin: true allowHostPID: false @@ -52,6 +54,8 @@ kind: SecurityContextConstraints apiVersion: security.openshift.io/v1 metadata: name: rook-ceph-csi + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} # To allow running privilegedContainers allowPrivilegedContainer: true # CSI daemonset pod needs hostnetworking diff --git a/deploy/charts/rook-ceph/templates/serviceaccount.yaml b/deploy/charts/rook-ceph/templates/serviceaccount.yaml index 2b5f7f265..3e9bd3b34 100644 --- a/deploy/charts/rook-ceph/templates/serviceaccount.yaml +++ b/deploy/charts/rook-ceph/templates/serviceaccount.yaml @@ -15,6 +15,8 @@ apiVersion: v1 metadata: name: rook-csi-cephfs-plugin-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} {{- if .Values.csi.nfs.enabled }} --- @@ -24,6 +26,8 @@ apiVersion: v1 metadata: name: rook-csi-nfs-plugin-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for the NFS CSI provisioner @@ -32,6 +36,8 @@ apiVersion: v1 metadata: name: rook-csi-nfs-provisioner-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} {{- end }} --- @@ -41,6 +47,8 @@ apiVersion: v1 metadata: name: rook-csi-cephfs-provisioner-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for the RBD CSI driver @@ -49,6 +57,8 @@ apiVersion: v1 metadata: name: rook-csi-rbd-plugin-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for the RBD CSI provisioner @@ -57,6 +67,8 @@ apiVersion: v1 metadata: name: rook-csi-rbd-provisioner-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for Ceph COSI driver diff --git a/deploy/examples/common.yaml b/deploy/examples/common.yaml index 49cd638b1..defa9688e 100644 --- a/deploy/examples/common.yaml +++ b/deploy/examples/common.yaml @@ -1463,6 +1463,11 @@ apiVersion: v1 metadata: name: rook-csi-cephfs-plugin-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -1472,6 +1477,11 @@ apiVersion: v1 metadata: name: rook-csi-cephfs-provisioner-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -1481,6 +1491,11 @@ apiVersion: v1 metadata: name: rook-csi-rbd-plugin-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -1490,5 +1505,10 @@ apiVersion: v1 metadata: name: rook-csi-rbd-provisioner-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret diff --git a/deploy/examples/csi/nfs/rbac.yaml b/deploy/examples/csi/nfs/rbac.yaml index a4b1f9b8b..efb45e90f 100644 --- a/deploy/examples/csi/nfs/rbac.yaml +++ b/deploy/examples/csi/nfs/rbac.yaml @@ -118,6 +118,11 @@ apiVersion: v1 metadata: name: rook-csi-nfs-plugin-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -127,5 +132,10 @@ apiVersion: v1 metadata: name: rook-csi-nfs-provisioner-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret