mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 21:46:22 +01:00
114 lines
3.0 KiB
Plaintext
114 lines
3.0 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// storage/persistent_storage/persistent-storage-efs.adoc
|
|
|
|
[id="efs-authorization_{context}"]
|
|
= Configuring authorization for EFS volumes
|
|
|
|
The EFS provisioner must be authorized to communicate to the AWS endpoints,
|
|
along with observing and updating {product-title} storage resources. The
|
|
following instructions create the necessary permissions for the EFS
|
|
provisioner.
|
|
|
|
.Procedure
|
|
|
|
. Create an `efs-provisioner` service account:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc create serviceaccount efs-provisioner
|
|
----
|
|
|
|
. Create a file, `clusterrole.yaml`, that defines the necessary permissions:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: efs-provisioner-runner
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumes"]
|
|
verbs: ["get", "list", "watch", "create", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumeclaims"]
|
|
verbs: ["get", "list", "watch", "update"]
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["storageclasses"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "update", "patch"]
|
|
- apiGroups: ["security.openshift.io"]
|
|
resources: ["securitycontextconstraints"]
|
|
verbs: ["use"]
|
|
resourceNames: ["hostmount-anyuid"]
|
|
----
|
|
|
|
. Create a file, `clusterrolebinding.yaml`, that defines a cluster role
|
|
binding that assigns the defined role to the service account:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: run-efs-provisioner
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: efs-provisioner
|
|
namespace: default <1>
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: efs-provisioner-runner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
----
|
|
<1> The namespace where the EFS provisioner pod will run. If the EFS
|
|
provisioner is running in a namespace other than `default`, this value must
|
|
be updated.
|
|
|
|
. Create a file, `role.yaml`, that defines a role with the necessary
|
|
permissions:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: leader-locking-efs-provisioner
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["endpoints"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
----
|
|
|
|
. Create a file, `rolebinding.yaml`, that defines a role binding that
|
|
assigns this role to the service account:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: leader-locking-efs-provisioner
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: efs-provisioner
|
|
namespace: default <1>
|
|
roleRef:
|
|
kind: Role
|
|
name: leader-locking-efs-provisioner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
----
|
|
<1> The namespace where the EFS provisioner pod will run. If the EFS
|
|
provisioner is running in a namespace other than `default`, this value must
|
|
be updated.
|
|
|
|
. Create the resources inside the {product-title} cluster:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc create -f clusterrole.yaml,clusterrolebinding.yaml,role.yaml,rolebinding.yaml
|
|
----
|