forked from rook/rook
Erik Sundell
e7a704ccf1
The helm charts allowed rendering a PodSecurityPolicy resource via the configuration `pspEnable`. This option is removed and all references to psp, PodSecurityPolicy, and Pod Security Policy have been cleaned up. The PSP resource was only rendered if k8s version was lower than 1.25 when it was still supported. It has been deprecated since k8s 1.21. Signed-off-by: Erik Sundell <erik@sundellopensource.se>
221 lines
5.5 KiB
YAML
221 lines
5.5 KiB
YAML
# This is a template to generate the necessary RBAC to deploy a second cluster into a namespace
|
|
# It assumes that common.yaml already ran
|
|
#
|
|
# Run me like:
|
|
# NAMESPACE=rook-ceph-secondary envsubst < tests/manifests/common-cluster-secondary.yaml | kubectl create -f -
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-cluster-mgmt
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-cluster-mgmt
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-system
|
|
namespace: rook-ceph # namespace:operator
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-cmd-reporter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-mgr-system-secondary
|
|
namespace: rook-ceph # namespace:operator
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-mgr-system
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-cmd-reporter
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
---
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
rules:
|
|
# this is needed for rook's "key-management" CLI to fetch the vault token from the secret when
|
|
# validating the connection details and for key rotation operations.
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
|
- apiGroups: ["ceph.rook.io"]
|
|
resources: ["cephclusters", "cephclusters/finalizers"]
|
|
verbs: ["get", "list", "create", "update", "delete"]
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-osd-external
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-osd-external
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-osd-external
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-osd-external
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-osd
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
# Service account for other components
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-default
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
labels:
|
|
operator: rook
|
|
storage-backend: ceph
|
|
# imagePullSecrets:
|
|
# - name: my-registry-secret
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-osd
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
# Aspects of ceph osd purge job that require access to the operator/cluster namespace
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-purge-osd
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["get", "delete"]
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs"]
|
|
verbs: ["get", "list", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumeclaims"]
|
|
verbs: ["get", "update", "delete", "list"]
|
|
---
|
|
# Allow the osd purge job to run in this namespace
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-purge-osd
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-purge-osd
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-purge-osd
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-purge-osd
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-rgw
|
|
namespace: rook-ceph-secondary # namespace:cluster
|
|
---
|
|
# Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-mgr-secondary-cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: rook-ceph-mgr-cluster
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-mgr
|
|
namespace: rook-ceph-secondary # namespace:cluster
|