alexlebens/external-snapshotter
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #130 from hoyho/rbac_secret

Browse Source 
minimize rbac permission by setting secrets as optional
This commit is contained in:
Kubernetes Prow Robot
2019-07-08 06:46:36 -07:00
committed by GitHub
parent b3f591d85c 8963b9d75e
commit c933d6dace
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
deploy/kubernetes/rbac.yaml
View File

@@ -32,9 +32,13 @@ rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["events"] resources: ["events"]
verbs: ["list", "watch", "create", "update", "patch"] verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: [""] # Secret permission is optional.
resources: ["secrets"] # Enable it if your driver needs secret.
verbs: ["get", "list"] # For example, `csi.storage.k8s.io/snapshotter-secret-name` is set in VolumeSnapshotClass.
# See https://kubernetes-csi.github.io/docs/secrets-and-credentials.html for more details.
# - apiGroups: [""]
# resources: ["secrets"]
# verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"] - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"] resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]