apps/ceph/kubespray/playbooks/roles/install/templates/common.yaml.j2

   1 ###################################################################################################################
   2 # Create the common resources that are necessary to start the operator and the ceph cluster.
   3 # These resources *must* be created before the operator.yaml and cluster.yaml or their variants.
   4 # The samples all assume that a single operator will manage a single cluster crd in the same "rook-ceph" namespace.
   5 #
   6 # If the operator needs to manage multiple clusters (in different namespaces), see the section below
   7 # for "cluster-specific resources". The resources below that section will need to be created for each namespace
   8 # where the operator needs to manage the cluster. The resources above that section do not be created again.
   9 #
  10 # Most of the sections are prefixed with a 'OLM' keyword which is used to build our CSV for an OLM (Operator Life Cycle manager)
  11 ###################################################################################################################
  12
  13 # Namespace where the operator and other rook resources are created
  14 apiVersion: v1
  15 kind: Namespace
  16 metadata:
  17   name: "{{ rook_namespace }}"
  18 # OLM: BEGIN CEPH CRD
  19 # The CRD declarations
  20 ---
  21 apiVersion: apiextensions.k8s.io/v1beta1
  22 kind: CustomResourceDefinition
  23 metadata:
  24   name: cephclusters.ceph.rook.io
  25 spec:
  26   group: ceph.rook.io
  27   names:
  28     kind: CephCluster
  29     listKind: CephClusterList
  30     plural: cephclusters
  31     singular: cephcluster
  32   scope: Namespaced
  33   version: v1
  34   validation:
  35     openAPIV3Schema:
  36       properties:
  37         spec:
  38           properties:
  39             annotations: {}
  40             cephVersion:
  41               properties:
  42                 allowUnsupported:
  43                   type: boolean
  44                 image:
  45                   type: string
  46             dashboard:
  47               properties:
  48                 enabled:
  49                   type: boolean
  50                 urlPrefix:
  51                   type: string
  52                 port:
  53                   type: integer
  54                   minimum: 0
  55                   maximum: 65535
  56                 ssl:
  57                   type: boolean
  58             dataDirHostPath:
  59               pattern: ^/(\S+)
  60               type: string
  61             skipUpgradeChecks:
  62               type: boolean
  63             mon:
  64               properties:
  65                 allowMultiplePerNode:
  66                   type: boolean
  67                 count:
  68                   maximum: 9
  69                   minimum: 0
  70                   type: integer
  71             mgr:
  72               properties:
  73                 modules:
  74                   items:
  75                     properties:
  76                       name:
  77                         type: string
  78                       enabled:
  79                         type: boolean
  80             network:
  81               properties:
  82                 hostNetwork:
  83                   type: boolean
  84             storage:
  85               properties:
  86                 disruptionManagement:
  87                   properties:
  88                     managePodBudgets:
  89                       type: boolean
  90                     osdMaintenanceTimeout:
  91                       type: integer
  92                     manageMachineDisruptionBudgets:
  93                       type: boolean
  94                 useAllNodes:
  95                   type: boolean
  96                 nodes:
  97                   items:
  98                     properties:
  99                       name:
 100                         type: string
 101                       config:
 102                         properties:
 103                           metadataDevice:
 104                             type: string
 105                           storeType:
 106                             type: string
 107                             pattern: ^(filestore|bluestore)$
 108                           databaseSizeMB:
 109                             type: string
 110                           walSizeMB:
 111                             type: string
 112                           journalSizeMB:
 113                             type: string
 114                           osdsPerDevice:
 115                             type: string
 116                           encryptedDevice:
 117                             type: string
 118                             pattern: ^(true|false)$
 119                       useAllDevices:
 120                         type: boolean
 121                       deviceFilter: {}
 122                       directories:
 123                         type: array
 124                         items:
 125                           properties:
 126                             path:
 127                               type: string
 128                       devices:
 129                         type: array
 130                         items:
 131                           properties:
 132                             name:
 133                               type: string
 134                             config: {}
 135                       location: {}
 136                       resources: {}
 137                   type: array
 138                 useAllDevices:
 139                   type: boolean
 140                 deviceFilter: {}
 141                 location: {}
 142                 directories:
 143                   type: array
 144                   items:
 145                     properties:
 146                       path:
 147                         type: string
 148                 config: {}
 149                 topologyAware:
 150                   type: boolean
 151             monitoring:
 152               properties:
 153                 enabled:
 154                   type: boolean
 155                 rulesNamespace:
 156                   type: string
 157             rbdMirroring:
 158               properties:
 159                 workers:
 160                   type: integer
 161             placement: {}
 162             resources: {}
 163   additionalPrinterColumns:
 164     - name: DataDirHostPath
 165       type: string
 166       description: Directory used on the K8s nodes
 167       JSONPath: .spec.dataDirHostPath
 168     - name: MonCount
 169       type: string
 170       description: Number of MONs
 171       JSONPath: .spec.mon.count
 172     - name: Age
 173       type: date
 174       JSONPath: .metadata.creationTimestamp
 175     - name: State
 176       type: string
 177       description: Current State
 178       JSONPath: .status.state
 179     - name: Health
 180       type: string
 181       description: Ceph Health
 182       JSONPath: .status.ceph.health
 183 # OLM: END CEPH CRD
 184 # OLM: BEGIN CEPH FS CRD
 185 ---
 186 apiVersion: apiextensions.k8s.io/v1beta1
 187 kind: CustomResourceDefinition
 188 metadata:
 189   name: cephfilesystems.ceph.rook.io
 190 spec:
 191   group: ceph.rook.io
 192   names:
 193     kind: CephFilesystem
 194     listKind: CephFilesystemList
 195     plural: cephfilesystems
 196     singular: cephfilesystem
 197   scope: Namespaced
 198   version: v1
 199   validation:
 200     openAPIV3Schema:
 201       properties:
 202         spec:
 203           properties:
 204             metadataServer:
 205               properties:
 206                 activeCount:
 207                   minimum: 1
 208                   maximum: 10
 209                   type: integer
 210                 activeStandby:
 211                   type: boolean
 212                 annotations: {}
 213                 placement: {}
 214                 resources: {}
 215             metadataPool:
 216               properties:
 217                 failureDomain:
 218                   type: string
 219                 replicated:
 220                   properties:
 221                     size:
 222                       minimum: 1
 223                       maximum: 10
 224                       type: integer
 225                 erasureCoded:
 226                   properties:
 227                     dataChunks:
 228                       type: integer
 229                     codingChunks:
 230                       type: integer
 231             dataPools:
 232               type: array
 233               items:
 234                 properties:
 235                   failureDomain:
 236                     type: string
 237                   replicated:
 238                     properties:
 239                       size:
 240                         minimum: 1
 241                         maximum: 10
 242                         type: integer
 243                   erasureCoded:
 244                     properties:
 245                       dataChunks:
 246                         type: integer
 247                       codingChunks:
 248                         type: integer
 249   additionalPrinterColumns:
 250     - name: ActiveMDS
 251       type: string
 252       description: Number of desired active MDS daemons
 253       JSONPath: .spec.metadataServer.activeCount
 254     - name: Age
 255       type: date
 256       JSONPath: .metadata.creationTimestamp
 257 # OLM: END CEPH FS CRD
 258 # OLM: BEGIN CEPH NFS CRD
 259 ---
 260 apiVersion: apiextensions.k8s.io/v1beta1
 261 kind: CustomResourceDefinition
 262 metadata:
 263   name: cephnfses.ceph.rook.io
 264 spec:
 265   group: ceph.rook.io
 266   names:
 267     kind: CephNFS
 268     listKind: CephNFSList
 269     plural: cephnfses
 270     singular: cephnfs
 271     shortNames:
 272     - nfs
 273   scope: Namespaced
 274   version: v1
 275   validation:
 276     openAPIV3Schema:
 277       properties:
 278         spec:
 279           properties:
 280             rados:
 281               properties:
 282                 pool:
 283                   type: string
 284                 namespace:
 285                   type: string
 286             server:
 287               properties:
 288                 active:
 289                   type: integer
 290                 annotations: {}
 291                 placement: {}
 292                 resources: {}
 293
 294 # OLM: END CEPH NFS CRD
 295 # OLM: BEGIN CEPH OBJECT STORE CRD
 296 ---
 297 apiVersion: apiextensions.k8s.io/v1beta1
 298 kind: CustomResourceDefinition
 299 metadata:
 300   name: cephobjectstores.ceph.rook.io
 301 spec:
 302   group: ceph.rook.io
 303   names:
 304     kind: CephObjectStore
 305     listKind: CephObjectStoreList
 306     plural: cephobjectstores
 307     singular: cephobjectstore
 308   scope: Namespaced
 309   version: v1
 310   validation:
 311     openAPIV3Schema:
 312       properties:
 313         spec:
 314           properties:
 315             gateway:
 316               properties:
 317                 type:
 318                   type: string
 319                 sslCertificateRef: {}
 320                 port:
 321                   type: integer
 322                 securePort: {}
 323                 instances:
 324                   type: integer
 325                 annotations: {}
 326                 placement: {}
 327                 resources: {}
 328             metadataPool:
 329               properties:
 330                 failureDomain:
 331                   type: string
 332                 replicated:
 333                   properties:
 334                     size:
 335                       type: integer
 336                 erasureCoded:
 337                   properties:
 338                     dataChunks:
 339                       type: integer
 340                     codingChunks:
 341                       type: integer
 342             dataPool:
 343               properties:
 344                 failureDomain:
 345                   type: string
 346                 replicated:
 347                   properties:
 348                     size:
 349                       type: integer
 350                 erasureCoded:
 351                   properties:
 352                     dataChunks:
 353                       type: integer
 354                     codingChunks:
 355                       type: integer
 356 # OLM: END CEPH OBJECT STORE CRD
 357 # OLM: BEGIN CEPH OBJECT STORE USERS CRD
 358 ---
 359 apiVersion: apiextensions.k8s.io/v1beta1
 360 kind: CustomResourceDefinition
 361 metadata:
 362   name: cephobjectstoreusers.ceph.rook.io
 363 spec:
 364   group: ceph.rook.io
 365   names:
 366     kind: CephObjectStoreUser
 367     listKind: CephObjectStoreUserList
 368     plural: cephobjectstoreusers
 369     singular: cephobjectstoreuser
 370   scope: Namespaced
 371   version: v1
 372 # OLM: END CEPH OBJECT STORE USERS CRD
 373 # OLM: BEGIN CEPH BLOCK POOL CRD
 374 ---
 375 apiVersion: apiextensions.k8s.io/v1beta1
 376 kind: CustomResourceDefinition
 377 metadata:
 378   name: cephblockpools.ceph.rook.io
 379 spec:
 380   group: ceph.rook.io
 381   names:
 382     kind: CephBlockPool
 383     listKind: CephBlockPoolList
 384     plural: cephblockpools
 385     singular: cephblockpool
 386   scope: Namespaced
 387   version: v1
 388 # OLM: END CEPH BLOCK POOL CRD
 389 # OLM: BEGIN CEPH VOLUME POOL CRD
 390 ---
 391 apiVersion: apiextensions.k8s.io/v1beta1
 392 kind: CustomResourceDefinition
 393 metadata:
 394   name: volumes.rook.io
 395 spec:
 396   group: rook.io
 397   names:
 398     kind: Volume
 399     listKind: VolumeList
 400     plural: volumes
 401     singular: volume
 402     shortNames:
 403     - rv
 404   scope: Namespaced
 405   version: v1alpha2
 406 # OLM: END CEPH VOLUME POOL CRD
 407 # OLM: BEGIN OBJECTBUCKET CRD
 408 ---
 409 apiVersion: apiextensions.k8s.io/v1beta1
 410 kind: CustomResourceDefinition
 411 metadata:
 412   name: objectbuckets.objectbucket.io
 413 spec:
 414   group: objectbucket.io
 415   versions:
 416     - name: v1alpha1
 417       served: true
 418       storage: true
 419   names:
 420     kind: ObjectBucket
 421     listKind: ObjectBucketList
 422     plural: objectbuckets
 423     singular: objectbucket
 424     shortNames:
 425       - ob
 426       - obs
 427   scope: Cluster
 428   subresources:
 429     status: {}
 430 # OLM: END OBJECTBUCKET CRD
 431 # OLM: BEGIN OBJECTBUCKETCLAIM CRD
 432 ---
 433 apiVersion: apiextensions.k8s.io/v1beta1
 434 kind: CustomResourceDefinition
 435 metadata:
 436   name: objectbucketclaims.objectbucket.io
 437 spec:
 438   versions:
 439     - name: v1alpha1
 440       served: true
 441       storage: true
 442   group: objectbucket.io
 443   names:
 444     kind: ObjectBucketClaim
 445     listKind: ObjectBucketClaimList
 446     plural: objectbucketclaims
 447     singular: objectbucketclaim
 448     shortNames:
 449       - obc
 450       - obcs
 451   scope: Namespaced
 452   subresources:
 453     status: {}
 454 # OLM: END OBJECTBUCKETCLAIM CRD
 455 # OLM: BEGIN OBJECTBUCKET ROLEBINDING
 456 ---
 457 kind: ClusterRoleBinding
 458 apiVersion: rbac.authorization.k8s.io/v1beta1
 459 metadata:
 460   name: rook-ceph-object-bucket
 461 roleRef:
 462   apiGroup: rbac.authorization.k8s.io
 463   kind: ClusterRole
 464   name: rook-ceph-object-bucket
 465 subjects:
 466   - kind: ServiceAccount
 467     name: rook-ceph-system
 468     namespace: "{{ rook_namespace }}"
 469 # OLM: END OBJECTBUCKET ROLEBINDING
 470 # OLM: BEGIN OPERATOR ROLE
 471 ---
 472 # The cluster role for managing all the cluster-specific resources in a namespace
 473 apiVersion: rbac.authorization.k8s.io/v1beta1
 474 kind: ClusterRole
 475 metadata:
 476   name: rook-ceph-cluster-mgmt
 477   labels:
 478     operator: rook
 479     storage-backend: ceph
 480 aggregationRule:
 481   clusterRoleSelectors:
 482   - matchLabels:
 483       rbac.ceph.rook.io/aggregate-to-rook-ceph-cluster-mgmt: "true"
 484 rules: []
 485 ---
 486 apiVersion: rbac.authorization.k8s.io/v1beta1
 487 kind: ClusterRole
 488 metadata:
 489   name: rook-ceph-cluster-mgmt-rules
 490   labels:
 491     operator: rook
 492     storage-backend: ceph
 493     rbac.ceph.rook.io/aggregate-to-rook-ceph-cluster-mgmt: "true"
 494 rules:
 495 - apiGroups:
 496   - ""
 497   resources:
 498   - secrets
 499   - pods
 500   - pods/log
 501   - services
 502   - configmaps
 503   verbs:
 504   - get
 505   - list
 506   - watch
 507   - patch
 508   - create
 509   - update
 510   - delete
 511 - apiGroups:
 512   - apps
 513   resources:
 514   - deployments
 515   - daemonsets
 516   verbs:
 517   - get
 518   - list
 519   - watch
 520   - create
 521   - update
 522   - delete
 523 ---
 524 # The role for the operator to manage resources in its own namespace
 525 apiVersion: rbac.authorization.k8s.io/v1beta1
 526 kind: Role
 527 metadata:
 528   name: rook-ceph-system
 529   namespace: "{{ rook_namespace }}"
 530   labels:
 531     operator: rook
 532     storage-backend: ceph
 533 rules:
 534 - apiGroups:
 535   - ""
 536   resources:
 537   - pods
 538   - configmaps
 539   - services
 540   verbs:
 541   - get
 542   - list
 543   - watch
 544   - patch
 545   - create
 546   - update
 547   - delete
 548 - apiGroups:
 549   - apps
 550   resources:
 551   - daemonsets
 552   - statefulsets
 553   - deployments
 554   verbs:
 555   - get
 556   - list
 557   - watch
 558   - create
 559   - update
 560   - delete
 561 ---
 562 # The cluster role for managing the Rook CRDs
 563 apiVersion: rbac.authorization.k8s.io/v1beta1
 564 kind: ClusterRole
 565 metadata:
 566   name: rook-ceph-global
 567   labels:
 568     operator: rook
 569     storage-backend: ceph
 570 aggregationRule:
 571   clusterRoleSelectors:
 572   - matchLabels:
 573       rbac.ceph.rook.io/aggregate-to-rook-ceph-global: "true"
 574 rules: []
 575 ---
 576 apiVersion: rbac.authorization.k8s.io/v1beta1
 577 kind: ClusterRole
 578 metadata:
 579   name: rook-ceph-global-rules
 580   labels:
 581     operator: rook
 582     storage-backend: ceph
 583     rbac.ceph.rook.io/aggregate-to-rook-ceph-global: "true"
 584 rules:
 585 - apiGroups:
 586   - ""
 587   resources:
 588   # Pod access is needed for fencing
 589   - pods
 590   # Node access is needed for determining nodes where mons should run
 591   - nodes
 592   - nodes/proxy
 593   verbs:
 594   - get
 595   - list
 596   - watch
 597 - apiGroups:
 598   - ""
 599   resources:
 600   - events
 601     # PVs and PVCs are managed by the Rook provisioner
 602   - persistentvolumes
 603   - persistentvolumeclaims
 604   - endpoints
 605   verbs:
 606   - get
 607   - list
 608   - watch
 609   - patch
 610   - create
 611   - update
 612   - delete
 613 - apiGroups:
 614   - storage.k8s.io
 615   resources:
 616   - storageclasses
 617   verbs:
 618   - get
 619   - list
 620   - watch
 621 - apiGroups:
 622   - batch
 623   resources:
 624   - jobs
 625   verbs:
 626   - get
 627   - list
 628   - watch
 629   - create
 630   - update
 631   - delete
 632 - apiGroups:
 633   - ceph.rook.io
 634   resources:
 635   - "*"
 636   verbs:
 637   - "*"
 638 - apiGroups:
 639   - rook.io
 640   resources:
 641   - "*"
 642   verbs:
 643   - "*"
 644 - apiGroups:
 645   - policy
 646   - apps
 647   resources:
 648   #this is for the clusterdisruption controller
 649   - poddisruptionbudgets
 650   #this is for both clusterdisruption and nodedrain controllers
 651   - deployments
 652   verbs:
 653   - "*"
 654 - apiGroups:
 655   - healthchecking.openshift.io
 656   resources:
 657   - machinedisruptionbudgets
 658   verbs:
 659   - get
 660   - list
 661   - watch
 662   - create
 663   - update
 664   - delete
 665 - apiGroups:
 666   - machine.openshift.io
 667   resources:
 668   - machines
 669   verbs:
 670   - get
 671   - list
 672   - watch
 673   - create
 674   - update
 675   - delete
 676 ---
 677 # Aspects of ceph-mgr that require cluster-wide access
 678 kind: ClusterRole
 679 apiVersion: rbac.authorization.k8s.io/v1beta1
 680 metadata:
 681   name: rook-ceph-mgr-cluster
 682   labels:
 683     operator: rook
 684     storage-backend: ceph
 685 aggregationRule:
 686   clusterRoleSelectors:
 687   - matchLabels:
 688       rbac.ceph.rook.io/aggregate-to-rook-ceph-mgr-cluster: "true"
 689 rules: []
 690 ---
 691 kind: ClusterRole
 692 apiVersion: rbac.authorization.k8s.io/v1beta1
 693 metadata:
 694   name: rook-ceph-mgr-cluster-rules
 695   labels:
 696     operator: rook
 697     storage-backend: ceph
 698     rbac.ceph.rook.io/aggregate-to-rook-ceph-mgr-cluster: "true"
 699 rules:
 700 - apiGroups:
 701   - ""
 702   resources:
 703   - configmaps
 704   - nodes
 705   - nodes/proxy
 706   verbs:
 707   - get
 708   - list
 709   - watch
 710 - apiGroups:
 711   - ""
 712   resources:
 713   - events
 714   verbs:
 715   - create
 716   - patch
 717   - list
 718   - get
 719   - watch
 720 ---
 721 kind: ClusterRole
 722 apiVersion: rbac.authorization.k8s.io/v1beta1
 723 metadata:
 724   name: rook-ceph-object-bucket
 725   labels:
 726     operator: rook
 727     storage-backend: ceph
 728     rbac.ceph.rook.io/aggregate-to-rook-ceph-mgr-cluster: "true"
 729 rules:
 730 - apiGroups:
 731   - ""
 732   verbs:
 733   - "*"
 734   resources:
 735   - secrets
 736   - configmaps
 737 - apiGroups:
 738     - storage.k8s.io
 739   resources:
 740     - storageclasses
 741   verbs:
 742     - get
 743     - list
 744     - watch
 745 - apiGroups:
 746   - "objectbucket.io"
 747   verbs:
 748   - "*"
 749   resources:
 750   - "*"
 751 # OLM: END OPERATOR ROLE
 752 # OLM: BEGIN SERVICE ACCOUNT SYSTEM
 753 ---
 754 # The rook system service account used by the operator, agent, and discovery pods
 755 apiVersion: v1
 756 kind: ServiceAccount
 757 metadata:
 758   name: rook-ceph-system
 759   namespace: "{{ rook_namespace }}"
 760   labels:
 761     operator: rook
 762     storage-backend: ceph
 763 # imagePullSecrets:
 764 # - name: my-registry-secret
 765
 766 # OLM: END SERVICE ACCOUNT SYSTEM
 767 # OLM: BEGIN OPERATOR ROLEBINDING
 768 ---
 769 # Grant the operator, agent, and discovery agents access to resources in the namespace
 770 kind: RoleBinding
 771 apiVersion: rbac.authorization.k8s.io/v1beta1
 772 metadata:
 773   name: rook-ceph-system
 774   namespace: "{{ rook_namespace }}"
 775   labels:
 776     operator: rook
 777     storage-backend: ceph
 778 roleRef:
 779   apiGroup: rbac.authorization.k8s.io
 780   kind: Role
 781   name: rook-ceph-system
 782 subjects:
 783 - kind: ServiceAccount
 784   name: rook-ceph-system
 785   namespace: "{{ rook_namespace }}"
 786 ---
 787 # Grant the rook system daemons cluster-wide access to manage the Rook CRDs, PVCs, and storage classes
 788 kind: ClusterRoleBinding
 789 apiVersion: rbac.authorization.k8s.io/v1beta1
 790 metadata:
 791   name: rook-ceph-global
 792   namespace: "{{ rook_namespace }}"
 793   labels:
 794     operator: rook
 795     storage-backend: ceph
 796 roleRef:
 797   apiGroup: rbac.authorization.k8s.io
 798   kind: ClusterRole
 799   name: rook-ceph-global
 800 subjects:
 801 - kind: ServiceAccount
 802   name: rook-ceph-system
 803   namespace: "{{ rook_namespace }}"
 804 # OLM: END OPERATOR ROLEBINDING
 805 #################################################################################################################
 806 # Beginning of cluster-specific resources. The example will assume the cluster will be created in the "rook-ceph"
 807 # namespace. If you want to create the cluster in a different namespace, you will need to modify these roles
 808 # and bindings accordingly.
 809 #################################################################################################################
 810 # Service account for the Ceph OSDs. Must exist and cannot be renamed.
 811 # OLM: BEGIN SERVICE ACCOUNT OSD
 812 ---
 813 apiVersion: v1
 814 kind: ServiceAccount
 815 metadata:
 816   name: rook-ceph-osd
 817   namespace: "{{ rook_namespace }}"
 818 # imagePullSecrets:
 819 # - name: my-registry-secret
 820
 821 # OLM: END SERVICE ACCOUNT OSD
 822 # OLM: BEGIN SERVICE ACCOUNT MGR
 823 ---
 824 # Service account for the Ceph Mgr. Must exist and cannot be renamed.
 825 apiVersion: v1
 826 kind: ServiceAccount
 827 metadata:
 828   name: rook-ceph-mgr
 829   namespace: "{{ rook_namespace }}"
 830 # imagePullSecrets:
 831 # - name: my-registry-secret
 832
 833 # OLM: END SERVICE ACCOUNT MGR
 834 # OLM: BEGIN CMD REPORTER SERVICE ACCOUNT
 835 ---
 836 apiVersion: v1
 837 kind: ServiceAccount
 838 metadata:
 839   name: rook-ceph-cmd-reporter
 840   namespace: "{{ rook_namespace }}"
 841 # OLM: END CMD REPORTER SERVICE ACCOUNT
 842 # OLM: BEGIN CLUSTER ROLE
 843 ---
 844 kind: Role
 845 apiVersion: rbac.authorization.k8s.io/v1beta1
 846 metadata:
 847   name: rook-ceph-osd
 848   namespace: "{{ rook_namespace }}"
 849 rules:
 850 - apiGroups: [""]
 851   resources: ["configmaps"]
 852   verbs: [ "get", "list", "watch", "create", "update", "delete" ]
 853 - apiGroups: ["ceph.rook.io"]
 854   resources: ["cephclusters", "cephclusters/finalizers"]
 855   verbs: [ "get", "list", "create", "update", "delete" ]
 856 ---
 857 kind: ClusterRole
 858 apiVersion: rbac.authorization.k8s.io/v1beta1
 859 metadata:
 860   name: rook-ceph-osd
 861   namespace: "{{ rook_namespace }}"
 862 rules:
 863 - apiGroups:
 864   - ""
 865   resources:
 866   - nodes
 867   verbs:
 868   - get
 869   - list
 870 ---
 871 # Aspects of ceph-mgr that require access to the system namespace
 872 kind: ClusterRole
 873 apiVersion: rbac.authorization.k8s.io/v1beta1
 874 metadata:
 875   name: rook-ceph-mgr-system
 876   namespace: "{{ rook_namespace }}"
 877 aggregationRule:
 878   clusterRoleSelectors:
 879   - matchLabels:
 880       rbac.ceph.rook.io/aggregate-to-rook-ceph-mgr-system: "true"
 881 rules: []
 882 ---
 883 kind: ClusterRole
 884 apiVersion: rbac.authorization.k8s.io/v1beta1
 885 metadata:
 886   name: rook-ceph-mgr-system-rules
 887   namespace: "{{ rook_namespace }}"
 888   labels:
 889       rbac.ceph.rook.io/aggregate-to-rook-ceph-mgr-system: "true"
 890 rules:
 891 - apiGroups:
 892   - ""
 893   resources:
 894   - configmaps
 895   verbs:
 896   - get
 897   - list
 898   - watch
 899 ---
 900 # Aspects of ceph-mgr that operate within the cluster's namespace
 901 kind: Role
 902 apiVersion: rbac.authorization.k8s.io/v1beta1
 903 metadata:
 904   name: rook-ceph-mgr
 905   namespace: "{{ rook_namespace }}"
 906 rules:
 907 - apiGroups:
 908   - ""
 909   resources:
 910   - pods
 911   - services
 912   verbs:
 913   - get
 914   - list
 915   - watch
 916 - apiGroups:
 917   - batch
 918   resources:
 919   - jobs
 920   verbs:
 921   - get
 922   - list
 923   - watch
 924   - create
 925   - update
 926   - delete
 927 - apiGroups:
 928   - ceph.rook.io
 929   resources:
 930   - "*"
 931   verbs:
 932   - "*"
 933 # OLM: END CLUSTER ROLE
 934 # OLM: BEGIN CMD REPORTER ROLE
 935 ---
 936 kind: Role
 937 apiVersion: rbac.authorization.k8s.io/v1beta1
 938 metadata:
 939   name: rook-ceph-cmd-reporter
 940   namespace: "{{ rook_namespace }}"
 941 rules:
 942 - apiGroups:
 943   - ""
 944   resources:
 945   - pods
 946   - configmaps
 947   verbs:
 948   - get
 949   - list
 950   - watch
 951   - create
 952   - update
 953   - delete
 954 # OLM: END CMD REPORTER ROLE
 955 # OLM: BEGIN CLUSTER ROLEBINDING
 956 ---
 957 # Allow the operator to create resources in this cluster's namespace
 958 kind: RoleBinding
 959 apiVersion: rbac.authorization.k8s.io/v1beta1
 960 metadata:
 961   name: rook-ceph-cluster-mgmt
 962   namespace: "{{ rook_namespace }}"
 963 roleRef:
 964   apiGroup: rbac.authorization.k8s.io
 965   kind: ClusterRole
 966   name: rook-ceph-cluster-mgmt
 967 subjects:
 968 - kind: ServiceAccount
 969   name: rook-ceph-system
 970   namespace: "{{ rook_namespace }}"
 971 ---
 972 # Allow the osd pods in this namespace to work with configmaps
 973 kind: RoleBinding
 974 apiVersion: rbac.authorization.k8s.io/v1beta1
 975 metadata:
 976   name: rook-ceph-osd
 977   namespace: "{{ rook_namespace }}"
 978 roleRef:
 979   apiGroup: rbac.authorization.k8s.io
 980   kind: Role
 981   name: rook-ceph-osd
 982 subjects:
 983 - kind: ServiceAccount
 984   name: rook-ceph-osd
 985   namespace: "{{ rook_namespace }}"
 986 ---
 987 # Allow the ceph mgr to access the cluster-specific resources necessary for the mgr modules
 988 kind: RoleBinding
 989 apiVersion: rbac.authorization.k8s.io/v1beta1
 990 metadata:
 991   name: rook-ceph-mgr
 992   namespace: "{{ rook_namespace }}"
 993 roleRef:
 994   apiGroup: rbac.authorization.k8s.io
 995   kind: Role
 996   name: rook-ceph-mgr
 997 subjects:
 998 - kind: ServiceAccount
 999   name: rook-ceph-mgr
1000   namespace: "{{ rook_namespace }}"
1001 ---
1002 # Allow the ceph mgr to access the rook system resources necessary for the mgr modules
1003 kind: RoleBinding
1004 apiVersion: rbac.authorization.k8s.io/v1beta1
1005 metadata:
1006   name: rook-ceph-mgr-system
1007   namespace: "{{ rook_namespace }}"
1008 roleRef:
1009   apiGroup: rbac.authorization.k8s.io
1010   kind: ClusterRole
1011   name: rook-ceph-mgr-system
1012 subjects:
1013 - kind: ServiceAccount
1014   name: rook-ceph-mgr
1015   namespace: "{{ rook_namespace }}"
1016 ---
1017 # Allow the ceph mgr to access cluster-wide resources necessary for the mgr modules
1018 kind: ClusterRoleBinding
1019 apiVersion: rbac.authorization.k8s.io/v1beta1
1020 metadata:
1021   name: rook-ceph-mgr-cluster
1022 roleRef:
1023   apiGroup: rbac.authorization.k8s.io
1024   kind: ClusterRole
1025   name: rook-ceph-mgr-cluster
1026 subjects:
1027 - kind: ServiceAccount
1028   name: rook-ceph-mgr
1029   namespace: "{{ rook_namespace }}"
1030
1031 ---
1032 # Allow the ceph osd to access cluster-wide resources necessary for determining their topology location
1033 kind: ClusterRoleBinding
1034 apiVersion: rbac.authorization.k8s.io/v1beta1
1035 metadata:
1036   name: rook-ceph-osd
1037 roleRef:
1038   apiGroup: rbac.authorization.k8s.io
1039   kind: ClusterRole
1040   name: rook-ceph-osd
1041 subjects:
1042 - kind: ServiceAccount
1043   name: rook-ceph-osd
1044   namespace: "{{ rook_namespace }}"
1045
1046 # OLM: END CLUSTER ROLEBINDING
1047 # OLM: BEGIN CMD REPORTER ROLEBINDING
1048 ---
1049 kind: RoleBinding
1050 apiVersion: rbac.authorization.k8s.io/v1beta1
1051 metadata:
1052   name: rook-ceph-cmd-reporter
1053   namespace: "{{ rook_namespace }}"
1054 roleRef:
1055   apiGroup: rbac.authorization.k8s.io
1056   kind: Role
1057   name: rook-ceph-cmd-reporter
1058 subjects:
1059 - kind: ServiceAccount
1060   name: rook-ceph-cmd-reporter
1061   namespace: "{{ rook_namespace }}"
1062 # OLM: END CMD REPORTER ROLEBINDING
1063 #################################################################################################################
1064 # Beginning of pod security policy resources. The example will assume the cluster will be created in the
1065 # "rook-ceph" namespace. If you want to create the cluster in a different namespace, you will need to modify
1066 # the roles and bindings accordingly.
1067 #################################################################################################################
1068 # OLM: BEGIN CLUSTER POD SECURITY POLICY
1069 ---
1070 apiVersion: policy/v1beta1
1071 kind: PodSecurityPolicy
1072 metadata:
1073   name: rook-privileged
1074 spec:
1075   privileged: true
1076   allowedCapabilities:
1077     # required by CSI
1078     - SYS_ADMIN
1079   # fsGroup - the flexVolume agent has fsGroup capabilities and could potentially be any group
1080   fsGroup:
1081     rule: RunAsAny
1082   # runAsUser, supplementalGroups - Rook needs to run some pods as root
1083   # Ceph pods could be run as the Ceph user, but that user isn't always known ahead of time
1084   runAsUser:
1085     rule: RunAsAny
1086   supplementalGroups:
1087     rule: RunAsAny
1088   # seLinux - seLinux context is unknown ahead of time; set if this is well-known
1089   seLinux:
1090     rule: RunAsAny
1091   volumes:
1092     # recommended minimum set
1093     - configMap
1094     - downwardAPI
1095     - emptyDir
1096     - persistentVolumeClaim
1097     - secret
1098     - projected
1099     # required for Rook
1100     - hostPath
1101     - flexVolume
1102   # allowedHostPaths can be set to Rook's known host volume mount points when they are fully-known
1103   # directory-based OSDs make this hard to nail down
1104   # allowedHostPaths:
1105   #   - pathPrefix: "/run/udev"  # for OSD prep
1106   #     readOnly: false
1107   #   - pathPrefix: "/dev"  # for OSD prep
1108   #     readOnly: false
1109   #   - pathPrefix: "/var/lib/rook"  # or whatever the dataDirHostPath value is set to
1110   #     readOnly: false
1111   # Ceph requires host IPC for setting up encrypted devices
1112   hostIPC: true
1113   # Ceph OSDs need to share the same PID namespace
1114   hostPID: true
1115   # hostNetwork can be set to 'false' if host networking isn't used
1116   hostNetwork: true
1117   hostPorts:
1118     # Ceph messenger protocol v1
1119     - min: 6789
1120       max: 6790 # <- support old default port
1121     # Ceph messenger protocol v2
1122     - min: 3300
1123       max: 3300
1124     # Ceph RADOS ports for OSDs, MDSes
1125     - min: 6800
1126       max: 7300
1127     # # Ceph dashboard port HTTP (not recommended)
1128     # - min: 7000
1129     #   max: 7000
1130     # Ceph dashboard port HTTPS
1131     - min: 8443
1132       max: 8443
1133     # Ceph mgr Prometheus Metrics
1134     - min: 9283
1135       max: 9283
1136 # OLM: END CLUSTER POD SECURITY POLICY
1137 # OLM: BEGIN POD SECURITY POLICY BINDINGS
1138 ---
1139 apiVersion: rbac.authorization.k8s.io/v1
1140 kind: ClusterRole
1141 metadata:
1142   name: 'psp:rook'
1143 rules:
1144   - apiGroups:
1145       - policy
1146     resources:
1147       - podsecuritypolicies
1148     resourceNames:
1149       - rook-privileged
1150     verbs:
1151       - use
1152 ---
1153 apiVersion: rbac.authorization.k8s.io/v1
1154 kind: ClusterRoleBinding
1155 metadata:
1156   name: rook-ceph-system-psp
1157 roleRef:
1158   apiGroup: rbac.authorization.k8s.io
1159   kind: ClusterRole
1160   name: 'psp:rook'
1161 subjects:
1162   - kind: ServiceAccount
1163     name: rook-ceph-system
1164     namespace: "{{ rook_namespace }}"
1165 ---
1166 apiVersion: rbac.authorization.k8s.io/v1
1167 kind: RoleBinding
1168 metadata:
1169   name: rook-ceph-default-psp
1170   namespace: "{{ rook_namespace }}"
1171 roleRef:
1172   apiGroup: rbac.authorization.k8s.io
1173   kind: ClusterRole
1174   name: psp:rook
1175 subjects:
1176 - kind: ServiceAccount
1177   name: default
1178   namespace: "{{ rook_namespace }}"
1179 ---
1180 apiVersion: rbac.authorization.k8s.io/v1
1181 kind: RoleBinding
1182 metadata:
1183   name: rook-ceph-osd-psp
1184   namespace: "{{ rook_namespace }}"
1185 roleRef:
1186   apiGroup: rbac.authorization.k8s.io
1187   kind: ClusterRole
1188   name: psp:rook
1189 subjects:
1190 - kind: ServiceAccount
1191   name: rook-ceph-osd
1192   namespace: "{{ rook_namespace }}"
1193 ---
1194 apiVersion: rbac.authorization.k8s.io/v1
1195 kind: RoleBinding
1196 metadata:
1197   name: rook-ceph-mgr-psp
1198   namespace: "{{ rook_namespace }}"
1199 roleRef:
1200   apiGroup: rbac.authorization.k8s.io
1201   kind: ClusterRole
1202   name: psp:rook
1203 subjects:
1204 - kind: ServiceAccount
1205   name: rook-ceph-mgr
1206   namespace: "{{ rook_namespace }}"
1207 ---
1208 apiVersion: rbac.authorization.k8s.io/v1
1209 kind: RoleBinding
1210 metadata:
1211   name: rook-ceph-cmd-reporter-psp
1212   namespace: "{{ rook_namespace }}"
1213 roleRef:
1214   apiGroup: rbac.authorization.k8s.io
1215   kind: ClusterRole
1216   name: psp:rook
1217 subjects:
1218 - kind: ServiceAccount
1219   name: rook-ceph-cmd-reporter
1220   namespace: "{{ rook_namespace }}"
1221 # OLM: END CLUSTER POD SECURITY POLICY BINDINGS
1222 # OLM: BEGIN CSI CEPHFS SERVICE ACCOUNT
1223 ---
1224 apiVersion: v1
1225 kind: ServiceAccount
1226 metadata:
1227   name: rook-csi-cephfs-plugin-sa
1228   namespace: "{{ rook_namespace }}"
1229 ---
1230 apiVersion: v1
1231 kind: ServiceAccount
1232 metadata:
1233   name: rook-csi-cephfs-provisioner-sa
1234   namespace: "{{ rook_namespace }}"
1235 # OLM: END CSI CEPHFS SERVICE ACCOUNT
1236 # OLM: BEGIN CSI CEPHFS ROLE
1237 ---
1238 kind: Role
1239 apiVersion: rbac.authorization.k8s.io/v1
1240 metadata:
1241   namespace: "{{ rook_namespace }}"
1242   name: cephfs-external-provisioner-cfg
1243 rules:
1244   - apiGroups: [""]
1245     resources: ["endpoints"]
1246     verbs: ["get", "watch", "list", "delete", "update", "create"]
1247   - apiGroups: [""]
1248     resources: ["configmaps"]
1249     verbs: ["get", "list", "create", "delete"]
1250   - apiGroups: ["coordination.k8s.io"]
1251     resources: ["leases"]
1252     verbs: ["get", "watch", "list", "delete", "update", "create"]
1253 # OLM: END CSI CEPHFS ROLE
1254 # OLM: BEGIN CSI CEPHFS ROLEBINDING
1255 ---
1256 kind: RoleBinding
1257 apiVersion: rbac.authorization.k8s.io/v1
1258 metadata:
1259   name: cephfs-csi-provisioner-role-cfg
1260   namespace: "{{ rook_namespace }}"
1261 subjects:
1262   - kind: ServiceAccount
1263     name: rook-csi-cephfs-provisioner-sa
1264     namespace: "{{ rook_namespace }}"
1265 roleRef:
1266   kind: Role
1267   name: cephfs-external-provisioner-cfg
1268   apiGroup: rbac.authorization.k8s.io
1269 # OLM: END CSI CEPHFS ROLEBINDING
1270 # OLM: BEGIN CSI CEPHFS CLUSTER ROLE
1271 ---
1272 kind: ClusterRole
1273 apiVersion: rbac.authorization.k8s.io/v1
1274 metadata:
1275   name: cephfs-csi-nodeplugin
1276 aggregationRule:
1277   clusterRoleSelectors:
1278   - matchLabels:
1279       rbac.ceph.rook.io/aggregate-to-cephfs-csi-nodeplugin: "true"
1280 rules: []
1281 ---
1282 kind: ClusterRole
1283 apiVersion: rbac.authorization.k8s.io/v1
1284 metadata:
1285   name: cephfs-csi-nodeplugin-rules
1286   labels:
1287     rbac.ceph.rook.io/aggregate-to-cephfs-csi-nodeplugin: "true"
1288 rules:
1289   - apiGroups: [""]
1290     resources: ["nodes"]
1291     verbs: ["get", "list", "update"]
1292   - apiGroups: [""]
1293     resources: ["namespaces"]
1294     verbs: ["get", "list"]
1295   - apiGroups: [""]
1296     resources: ["persistentvolumes"]
1297     verbs: ["get", "list", "watch", "update"]
1298   - apiGroups: ["storage.k8s.io"]
1299     resources: ["volumeattachments"]
1300     verbs: ["get", "list", "watch", "update"]
1301   - apiGroups: [""]
1302     resources: ["configmaps"]
1303     verbs: ["get", "list"]
1304 ---
1305 kind: ClusterRole
1306 apiVersion: rbac.authorization.k8s.io/v1
1307 metadata:
1308   name: cephfs-external-provisioner-runner
1309 aggregationRule:
1310   clusterRoleSelectors:
1311   - matchLabels:
1312       rbac.ceph.rook.io/aggregate-to-cephfs-external-provisioner-runner: "true"
1313 rules: []
1314 ---
1315 kind: ClusterRole
1316 apiVersion: rbac.authorization.k8s.io/v1
1317 metadata:
1318   name: cephfs-external-provisioner-runner-rules
1319   labels:
1320     rbac.ceph.rook.io/aggregate-to-cephfs-external-provisioner-runner: "true"
1321 rules:
1322   - apiGroups: [""]
1323     resources: ["secrets"]
1324     verbs: ["get", "list"]
1325   - apiGroups: [""]
1326     resources: ["persistentvolumes"]
1327     verbs: ["get", "list", "watch", "create", "delete", "update"]
1328   - apiGroups: [""]
1329     resources: ["persistentvolumeclaims"]
1330     verbs: ["get", "list", "watch", "update"]
1331   - apiGroups: ["storage.k8s.io"]
1332     resources: ["storageclasses"]
1333     verbs: ["get", "list", "watch"]
1334   - apiGroups: [""]
1335     resources: ["events"]
1336     verbs: ["list", "watch", "create", "update", "patch"]
1337   - apiGroups: ["storage.k8s.io"]
1338     resources: ["volumeattachments"]
1339     verbs: ["get", "list", "watch", "update"]
1340   - apiGroups: [""]
1341     resources: ["nodes"]
1342     verbs: ["get", "list", "watch"]
1343 # OLM: END CSI CEPHFS CLUSTER ROLE
1344 # OLM: BEGIN CSI CEPHFS CLUSTER ROLEBINDING
1345 ---
1346 apiVersion: rbac.authorization.k8s.io/v1
1347 kind: ClusterRoleBinding
1348 metadata:
1349   name: rook-csi-cephfs-plugin-sa-psp
1350 roleRef:
1351   apiGroup: rbac.authorization.k8s.io
1352   kind: ClusterRole
1353   name: 'psp:rook'
1354 subjects:
1355   - kind: ServiceAccount
1356     name: rook-csi-cephfs-plugin-sa
1357     namespace: "{{ rook_namespace }}"
1358 ---
1359 apiVersion: rbac.authorization.k8s.io/v1
1360 kind: ClusterRoleBinding
1361 metadata:
1362   name: rook-csi-cephfs-provisioner-sa-psp
1363 roleRef:
1364   apiGroup: rbac.authorization.k8s.io
1365   kind: ClusterRole
1366   name: 'psp:rook'
1367 subjects:
1368   - kind: ServiceAccount
1369     name: rook-csi-cephfs-provisioner-sa
1370     namespace: "{{ rook_namespace }}"
1371 ---
1372 kind: ClusterRoleBinding
1373 apiVersion: rbac.authorization.k8s.io/v1
1374 metadata:
1375   name: cephfs-csi-nodeplugin
1376 subjects:
1377   - kind: ServiceAccount
1378     name: rook-csi-cephfs-plugin-sa
1379     namespace: "{{ rook_namespace }}"
1380 roleRef:
1381   kind: ClusterRole
1382   name: cephfs-csi-nodeplugin
1383   apiGroup: rbac.authorization.k8s.io
1384
1385 ---
1386 kind: ClusterRoleBinding
1387 apiVersion: rbac.authorization.k8s.io/v1
1388 metadata:
1389   name: cephfs-csi-provisioner-role
1390 subjects:
1391   - kind: ServiceAccount
1392     name: rook-csi-cephfs-provisioner-sa
1393     namespace: "{{ rook_namespace }}"
1394 roleRef:
1395   kind: ClusterRole
1396   name: cephfs-external-provisioner-runner
1397   apiGroup: rbac.authorization.k8s.io
1398 # OLM: END CSI CEPHFS CLUSTER ROLEBINDING
1399 # OLM: BEGIN CSI RBD SERVICE ACCOUNT
1400 ---
1401 apiVersion: v1
1402 kind: ServiceAccount
1403 metadata:
1404   name: rook-csi-rbd-plugin-sa
1405   namespace: "{{ rook_namespace }}"
1406 ---
1407 apiVersion: v1
1408 kind: ServiceAccount
1409 metadata:
1410   name: rook-csi-rbd-provisioner-sa
1411   namespace: "{{ rook_namespace }}"
1412 # OLM: END CSI RBD SERVICE ACCOUNT
1413 # OLM: BEGIN CSI RBD ROLE
1414 ---
1415 kind: Role
1416 apiVersion: rbac.authorization.k8s.io/v1
1417 metadata:
1418   namespace: "{{ rook_namespace }}"
1419   name: rbd-external-provisioner-cfg
1420 rules:
1421   - apiGroups: [""]
1422     resources: ["endpoints"]
1423     verbs: ["get", "watch", "list", "delete", "update", "create"]
1424   - apiGroups: [""]
1425     resources: ["configmaps"]
1426     verbs: ["get", "list", "watch", "create", "delete"]
1427   - apiGroups: ["coordination.k8s.io"]
1428     resources: ["leases"]
1429     verbs: ["get", "watch", "list", "delete", "update", "create"]
1430 # OLM: END CSI RBD ROLE
1431 # OLM: BEGIN CSI RBD ROLEBINDING
1432 ---
1433 kind: RoleBinding
1434 apiVersion: rbac.authorization.k8s.io/v1
1435 metadata:
1436   name: rbd-csi-provisioner-role-cfg
1437   namespace: "{{ rook_namespace }}"
1438 subjects:
1439   - kind: ServiceAccount
1440     name: rook-csi-rbd-provisioner-sa
1441     namespace: "{{ rook_namespace }}"
1442 roleRef:
1443   kind: Role
1444   name: rbd-external-provisioner-cfg
1445   apiGroup: rbac.authorization.k8s.io
1446 # OLM: END CSI RBD ROLEBINDING
1447 # OLM: BEGIN CSI RBD CLUSTER ROLE
1448 ---
1449 kind: ClusterRole
1450 apiVersion: rbac.authorization.k8s.io/v1
1451 metadata:
1452   name: rbd-csi-nodeplugin
1453 aggregationRule:
1454   clusterRoleSelectors:
1455   - matchLabels:
1456       rbac.ceph.rook.io/aggregate-to-rbd-csi-nodeplugin: "true"
1457 rules: []
1458 ---
1459 kind: ClusterRole
1460 apiVersion: rbac.authorization.k8s.io/v1
1461 metadata:
1462   name: rbd-csi-nodeplugin-rules
1463   labels:
1464     rbac.ceph.rook.io/aggregate-to-rbd-csi-nodeplugin: "true"
1465 rules:
1466   - apiGroups: [""]
1467     resources: ["secrets"]
1468     verbs: ["get", "list"]
1469   - apiGroups: [""]
1470     resources: ["nodes"]
1471     verbs: ["get", "list", "update"]
1472   - apiGroups: [""]
1473     resources: ["namespaces"]
1474     verbs: ["get", "list"]
1475   - apiGroups: [""]
1476     resources: ["persistentvolumes"]
1477     verbs: ["get", "list", "watch", "update"]
1478   - apiGroups: ["storage.k8s.io"]
1479     resources: ["volumeattachments"]
1480     verbs: ["get", "list", "watch", "update"]
1481   - apiGroups: [""]
1482     resources: ["configmaps"]
1483     verbs: ["get", "list"]
1484 ---
1485 kind: ClusterRole
1486 apiVersion: rbac.authorization.k8s.io/v1
1487 metadata:
1488   name: rbd-external-provisioner-runner
1489 aggregationRule:
1490   clusterRoleSelectors:
1491   - matchLabels:
1492       rbac.ceph.rook.io/aggregate-to-rbd-external-provisioner-runner: "true"
1493 rules: []
1494 ---
1495 kind: ClusterRole
1496 apiVersion: rbac.authorization.k8s.io/v1
1497 metadata:
1498   name: rbd-external-provisioner-runner-rules
1499   labels:
1500     rbac.ceph.rook.io/aggregate-to-rbd-external-provisioner-runner: "true"
1501 rules:
1502   - apiGroups: [""]
1503     resources: ["secrets"]
1504     verbs: ["get", "list"]
1505   - apiGroups: [""]
1506     resources: ["persistentvolumes"]
1507     verbs: ["get", "list", "watch", "create", "delete", "update"]
1508   - apiGroups: [""]
1509     resources: ["persistentvolumeclaims"]
1510     verbs: ["get", "list", "watch", "update"]
1511   - apiGroups: ["storage.k8s.io"]
1512     resources: ["volumeattachments"]
1513     verbs: ["get", "list", "watch", "update"]
1514   - apiGroups: [""]
1515     resources: ["nodes"]
1516     verbs: ["get", "list", "watch"]
1517   - apiGroups: ["storage.k8s.io"]
1518     resources: ["storageclasses"]
1519     verbs: ["get", "list", "watch"]
1520   - apiGroups: [""]
1521     resources: ["events"]
1522     verbs: ["list", "watch", "create", "update", "patch"]
1523   - apiGroups: ["snapshot.storage.k8s.io"]
1524     resources: ["volumesnapshots"]
1525     verbs: ["get", "list", "watch", "update"]
1526   - apiGroups: ["snapshot.storage.k8s.io"]
1527     resources: ["volumesnapshotcontents"]
1528     verbs: ["create", "get", "list", "watch", "update", "delete"]
1529   - apiGroups: ["snapshot.storage.k8s.io"]
1530     resources: ["volumesnapshotclasses"]
1531     verbs: ["get", "list", "watch"]
1532   - apiGroups: ["apiextensions.k8s.io"]
1533     resources: ["customresourcedefinitions"]
1534     verbs: ["create", "list", "watch", "delete", "get", "update"]
1535   - apiGroups: ["snapshot.storage.k8s.io"]
1536     resources: ["volumesnapshots/status"]
1537     verbs: ["update"]
1538 # OLM: END CSI RBD CLUSTER ROLE
1539 # OLM: BEGIN CSI RBD CLUSTER ROLEBINDING
1540 ---
1541 apiVersion: rbac.authorization.k8s.io/v1
1542 kind: ClusterRoleBinding
1543 metadata:
1544   name: rook-csi-rbd-plugin-sa-psp
1545 roleRef:
1546   apiGroup: rbac.authorization.k8s.io
1547   kind: ClusterRole
1548   name: 'psp:rook'
1549 subjects:
1550   - kind: ServiceAccount
1551     name: rook-csi-rbd-plugin-sa
1552     namespace: "{{ rook_namespace }}"
1553 ---
1554 apiVersion: rbac.authorization.k8s.io/v1
1555 kind: ClusterRoleBinding
1556 metadata:
1557   name: rook-csi-rbd-provisioner-sa-psp
1558 roleRef:
1559   apiGroup: rbac.authorization.k8s.io
1560   kind: ClusterRole
1561   name: 'psp:rook'
1562 subjects:
1563   - kind: ServiceAccount
1564     name: rook-csi-rbd-provisioner-sa
1565     namespace: "{{ rook_namespace }}"
1566 ---
1567 kind: ClusterRoleBinding
1568 apiVersion: rbac.authorization.k8s.io/v1
1569 metadata:
1570   name: rbd-csi-nodeplugin
1571 subjects:
1572   - kind: ServiceAccount
1573     name: rook-csi-rbd-plugin-sa
1574     namespace: "{{ rook_namespace }}"
1575 roleRef:
1576   kind: ClusterRole
1577   name: rbd-csi-nodeplugin
1578   apiGroup: rbac.authorization.k8s.io
1579 ---
1580 kind: ClusterRoleBinding
1581 apiVersion: rbac.authorization.k8s.io/v1
1582 metadata:
1583   name: rbd-csi-provisioner-role
1584 subjects:
1585   - kind: ServiceAccount
1586     name: rook-csi-rbd-provisioner-sa
1587     namespace: "{{ rook_namespace }}"
1588 roleRef:
1589   kind: ClusterRole
1590   name: rbd-external-provisioner-runner
1591   apiGroup: rbac.authorization.k8s.io
1592 # OLM: END CSI RBD CLUSTER ROLEBINDING