Skip to content

K
k3s
Commit dc6be0cb authored by Jan Safranek's avatar Jan Safranek Committed by Hemant Kumar
Browse files
Options

Add new RBAC rules for CSIDriver

Nodes need to watch CSIDrivers to know if they should send pod information in NodePublish.
parent db94508a
Hide whitespace changes
Inline Side-by-side
Showing with 1 addition and 1 deletion
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
View file @ dc6be0cb
......@@ -159,7 +159,7 @@ func NodeRules() []rbacv1.PolicyRule {
if utilfeature.DefaultFeatureGate.Enabled(features.CSIPersistentVolume) {
volAttachRule := rbacv1helpers.NewRule("get").Groups(storageGroup).Resources("volumeattachments").RuleOrDie()
nodePolicyRules = append(nodePolicyRules, volAttachRule)
if utilfeature.DefaultFeatureGate.Enabled(features.CSISkipAttach) {
if utilfeature.DefaultFeatureGate.Enabled(features.CSISkipAttach) || utilfeature.DefaultFeatureGate.Enabled(features.CSIPodInfo) {
csiDriverRule := rbacv1helpers.NewRule("get", "watch", "list").Groups("csi.storage.k8s.io").Resources("csidrivers").RuleOrDie()
nodePolicyRules = append(nodePolicyRules, csiDriverRule)
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment