mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 21:46:22 +01:00
Merge pull request #64938 from openshift-cherrypick-robot/cherry-pick-64489-to-enterprise-4.14
[enterprise-4.14] CNV-28780: RBAC roles for storage
This commit is contained in:
Pan Ousley
@@ -1,6 +1,6 @@
|
||||
// Module included in the following assemblies:
|
||||
//
|
||||
// * virt/virt-additional-security-privileges-controller-and-launcher.adoc
|
||||
// * virt/about_virt/virt-security-policies.adoc
|
||||
|
||||
:_content-type: REFERENCE
|
||||
[id="default-cluster-roles-for-virt_{context}"]
|
||||
|
||||
240
modules/virt-storage-rbac-roles.adoc
Normal file
240
modules/virt-storage-rbac-roles.adoc
Normal file
@@ -0,0 +1,240 @@
|
||||
// Module included in the following assemblies:
|
||||
//
|
||||
// * virt/about_virt/virt-security-policies.adoc
|
||||
|
||||
:_content-type: REFERENCE
|
||||
[id="virt-storage-rbac-roles_{context}"]
|
||||
= RBAC roles for storage features in {VirtProductName}
|
||||
|
||||
The following permissions are granted to the Containerized Data Importer (CDI), including the `cdi-operator` and `cdi-controller` service accounts.
|
||||
|
||||
[id="cluster-wide-rbac-roles-cdi"]
|
||||
== Cluster-wide RBAC roles
|
||||
|
||||
.Aggregated cluster roles for the `cdi.kubevirt.io` API group
|
||||
[cols="1,2,1",options="header"]
|
||||
|===
|
||||
| CDI cluster role
|
||||
| Resources
|
||||
| Verbs
|
||||
|
||||
.2+.^| `cdi.kubevirt.io:admin`
|
||||
.^| `datavolumes`, `uploadtokenrequests`
|
||||
.^| `*` (all)
|
||||
|
||||
.^| `datavolumes/source`
|
||||
.^| `create`
|
||||
|
||||
.2+.^| `cdi.kubevirt.io:edit`
|
||||
.^| `datavolumes`, `uploadtokenrequests`
|
||||
.^| `*`
|
||||
|
||||
.^| `datavolumes/source`
|
||||
.^| `create`
|
||||
|
||||
.2+.^| `cdi.kubevirt.io:view`
|
||||
.^| `cdiconfigs`, `dataimportcrons`, `datasources`, `datavolumes`, `objecttransfers`, `storageprofiles`, `volumeimportsources`, `volumeuploadsources`, `volumeclonesources`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `datavolumes/source`
|
||||
.^| `create`
|
||||
|
||||
.^| `cdi.kubevirt.io:config-reader`
|
||||
.^| `cdiconfigs`, `storageprofiles`
|
||||
.^| `get`, `list`, `watch`
|
||||
|===
|
||||
|
||||
.Cluster-wide roles for the `cdi-operator` service account
|
||||
[cols="1,1,2",options="header"]
|
||||
|===
|
||||
| API group
|
||||
| Resources
|
||||
| Verbs
|
||||
|
||||
.^| `rbac.authorization.k8s.io`
|
||||
.^| `clusterrolebindings`, `clusterroles`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
|
||||
|
||||
.^| `security.openshift.io`
|
||||
.^| `securitycontextconstraints`
|
||||
.^| `get`, `list`, `watch`, `update`, `create`
|
||||
|
||||
.^| `apiextensions.k8s.io`
|
||||
.^| `customresourcedefinitions`, `customresourcedefinitions/status`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
|
||||
|
||||
.^| `cdi.kubevirt.io`
|
||||
.^| `*`
|
||||
.^| `*`
|
||||
|
||||
.^| `upload.cdi.kubevirt.io`
|
||||
.^| `*`
|
||||
.^| `*`
|
||||
|
||||
.^| `admissionregistration.k8s.io`
|
||||
.^| `validatingwebhookconfigurations`, `mutatingwebhookconfigurations`
|
||||
.^| `create`, `list`, `watch`
|
||||
|
||||
.^| `admissionregistration.k8s.io`
|
||||
.^| `validatingwebhookconfigurations`
|
||||
|
||||
Allow list: `cdi-api-dataimportcron-validate, cdi-api-populator-validate, cdi-api-datavolume-validate, cdi-api-validate, objecttransfer-api-validate`
|
||||
.^| `get`, `update`, `delete`
|
||||
|
||||
.^| `admissionregistration.k8s.io`
|
||||
.^| `mutatingwebhookconfigurations`
|
||||
|
||||
Allow list: `cdi-api-datavolume-mutate`
|
||||
.^| `get`, `update`, `delete`
|
||||
|
||||
.^| `apiregistration.k8s.io`
|
||||
.^| `apiservices`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
|
||||
|===
|
||||
|
||||
.Cluster-wide roles for the `cdi-controller` service account
|
||||
[cols="1,1,2",options="header"]
|
||||
|===
|
||||
| API group
|
||||
| Resources
|
||||
| Verbs
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `events`
|
||||
.^| `create`, `patch`
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `persistentvolumeclaims`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `delete`, `deletecollection`, `patch`
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `persistentvolumes`
|
||||
.^| `get`, `list`, `watch`, `update`
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `persistentvolumeclaims/finalizers`, `pods/finalizers`
|
||||
.^| `update`
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `pods`, `services`
|
||||
.^| `get`, `list`, `watch`, `create`, `delete`
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `configmaps`
|
||||
.^| `get`, `create`
|
||||
|
||||
.^| `storage.k8s.io`
|
||||
.^| `storageclasses`, `csidrivers`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `config.openshift.io`
|
||||
.^| `proxies`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `cdi.kubevirt.io`
|
||||
.^| `*`
|
||||
.^| `*`
|
||||
|
||||
.^| `snapshot.storage.k8s.io`
|
||||
.^| `volumesnapshots`, `volumesnapshotclasses`, `volumesnapshotcontents`
|
||||
.^| `get`, `list`, `watch`, `create`, `delete`
|
||||
|
||||
.^| `snapshot.storage.k8s.io`
|
||||
.^| `volumesnapshots`
|
||||
.^| `update`, `deletecollection`
|
||||
|
||||
.^| `apiextensions.k8s.io`
|
||||
.^| `customresourcedefinitions`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `scheduling.k8s.io`
|
||||
.^| `priorityclasses`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `image.openshift.io`
|
||||
.^| `imagestreams`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `secrets`
|
||||
.^| `create`
|
||||
|
||||
.^| `kubevirt.io`
|
||||
.^| `virtualmachines/finalizers`
|
||||
.^| `update`
|
||||
|===
|
||||
|
||||
[id="namespaced-rbac-roles-cdi"]
|
||||
== Namespaced RBAC roles
|
||||
|
||||
.Namespaced roles for the `cdi-operator` service account
|
||||
[cols="1,1,2",options="header"]
|
||||
|===
|
||||
| API group
|
||||
| Resources
|
||||
| Verbs
|
||||
|
||||
.^| `rbac.authorization.k8s.io`
|
||||
.^| `rolebindings`, `roles`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `serviceaccounts`, `configmaps`, `events`, `secrets`, `services`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `patch`, `delete`
|
||||
|
||||
.^| `apps`
|
||||
.^| `deployments`, `deployments/finalizers`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
|
||||
|
||||
.^| `route.openshift.io`
|
||||
.^| `routes`, `routes/custom-host`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`
|
||||
|
||||
.^| `config.openshift.io`
|
||||
.^| `proxies`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `monitoring.coreos.com`
|
||||
.^| `servicemonitors`, `prometheusrules`
|
||||
.^| `get`, `list`, `watch`, `create`, `delete`, `update`, `patch`
|
||||
|
||||
.^| `coordination.k8s.io`
|
||||
.^| `leases`
|
||||
.^| `get`, `create`, `update`
|
||||
|===
|
||||
|
||||
.Namespaced roles for the `cdi-controller` service account
|
||||
[cols="1,1,2",options="header"]
|
||||
|===
|
||||
| API group
|
||||
| Resources
|
||||
| Verbs
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `configmaps`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
|
||||
|
||||
.^| `""` (core)
|
||||
.^| `secrets`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `batch`
|
||||
.^| `cronjobs`
|
||||
.^| `get`, `list`, `watch`, `create`, `update`, `delete`
|
||||
|
||||
.^| `batch`
|
||||
.^| `jobs`
|
||||
.^| `create`, `delete`, `list`, `watch`
|
||||
|
||||
.^| `coordination.k8s.io`
|
||||
.^| `leases`
|
||||
.^| `get`, `create`, `update`
|
||||
|
||||
.^| `networking.k8s.io`
|
||||
.^| `ingresses`
|
||||
.^| `get`, `list`, `watch`
|
||||
|
||||
.^| `route.openshift.io`
|
||||
.^| `routes`
|
||||
.^| `get`, `list`, `watch`
|
||||
|===
|
||||
@@ -16,23 +16,26 @@ Learn about {VirtProductName} security and authorization.
|
||||
|
||||
include::modules/virt-about-workload-security.adoc[leveloffset=+1]
|
||||
|
||||
include::modules/virt-additional-scc-for-kubevirt-controller.adoc[leveloffset=+1]
|
||||
include::modules/virt-automatic-certificates-renewal.adoc[leveloffset=+1]
|
||||
|
||||
[id="authorization_virt-security-policies"]
|
||||
== Authorization
|
||||
|
||||
{VirtProductName} uses xref:../../authentication/using-rbac.adoc#using-rbac[role-based access control] (RBAC) for authorization. For example, an administrator can create an RBAC role that provides the permissions required to launch a virtual machine. The administrator can then restrict access to that feature by binding the role to specific users.
|
||||
{VirtProductName} uses xref:../../authentication/using-rbac.adoc#using-rbac[role-based access control] (RBAC) to define permissions for human users and service accounts. The permissions defined for service accounts control the actions that {VirtProductName} components can perform.
|
||||
|
||||
You can also use RBAC roles to manage user access to virtualization features. For example, an administrator can create an RBAC role that provides the permissions required to launch a virtual machine. The administrator can then restrict access by binding the role to specific users.
|
||||
|
||||
include::modules/virt-default-cluster-roles.adoc[leveloffset=+2]
|
||||
|
||||
[discrete]
|
||||
include::modules/virt-storage-rbac-roles.adoc[leveloffset=+2]
|
||||
|
||||
include::modules/virt-additional-scc-for-kubevirt-controller.adoc[leveloffset=+2]
|
||||
|
||||
[role="_additional-resources"]
|
||||
[id="additional-resources_authorization"]
|
||||
[id="additional-resources_{context}"]
|
||||
== Additional resources
|
||||
* xref:../../authentication/managing-security-context-constraints.adoc#security-context-constraints-about_configuring-internal-oauth[Managing security context constraints]
|
||||
* xref:../../authentication/using-rbac.adoc#using-rbac[Using RBAC to define and apply permissions]
|
||||
* xref:../../authentication/using-rbac.adoc#creating-cluster-role_using-rbac[Creating a cluster role]
|
||||
* xref:../../authentication/using-rbac.adoc#cluster-role-binding-commands_using-rbac[Cluster role binding commands]
|
||||
* xref:../../virt/virtual_machines/cloning_vms/virt-enabling-user-permissions-to-clone-datavolumes.adoc#virt-enabling-user-permissions-to-clone-datavolumes[Enabling user permissions to clone data volumes across namespaces]
|
||||
|
||||
include::modules/virt-automatic-certificates-renewal.adoc[leveloffset=+1]
|
||||
* xref:../../virt/virtual_machines/cloning_vms/virt-enabling-user-permissions-to-clone-datavolumes.adoc#virt-enabling-user-permissions-to-clone-datavolumes[Enabling user permissions to clone data volumes across namespaces]
|
||||
Reference in New Issue
Block a user