Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ceph: Add RBAC in helm chart for mgr to create service monitor #9383

Closed
wants to merge 1 commit into from
Closed

ceph: Add RBAC in helm chart for mgr to create service monitor #9383

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions Documentation/helm-operator.md
View file
Open in desktop
Expand Up @@ -83,6 +83,7 @@ The following tables lists the configurable parameters of the rook-operator char
| `crds.enabled` | If true, the helm chart will create the Rook CRDs. Do NOT change to `false` in a running cluster or CRs will be deleted! | `true` |
| `rbacEnable` | If true, create & use RBAC resources | `true` |
| `pspEnable` | If true, create & use PSP resources | `true` |
| `monitoring.enabled` | Enable Prometheus integration, currently will only create necessary RBAC rules | `true` |
| `resources` | Pod resource requests & limits | `{}` |
| `annotations` | Pod annotations | `{}` |
| `logLevel` | Global log level | `INFO` |
Expand Down
10 changes: 10 additions & 0 deletions deploy/charts/rook-ceph/templates/cluster-rbac.yaml
View file
Open in desktop
Expand Up @@ -26,8 +26,18 @@ roles
---
{{ include "library.cluster.roles" . }}

{{- if .Values.monitoring.enabled }}
---
{{ include "library.cluster.monitoring.roles" . }}
{{- end }}

{{/*
rolebindings
*/}}
---
{{ include "library.cluster.rolebindings" . }}

{{- if .Values.monitoring.enabled }}
---
{{ include "library.cluster.monitoring.rolebindings" . }}
{{- end }}
4 changes: 4 additions & 0 deletions deploy/charts/rook-ceph/values.yaml
View file
Open in desktop
Expand Up @@ -52,6 +52,10 @@ rbacEnable: true
##
pspEnable: true

monitoring:
# enabling will create RBAC rules to allow Operator to create ServiceMonitors
enabled: true

Comment on lines +55 to +58
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Monitoring should not be enabled for all users by default. For our releases that go out to hundreds of users, we'd like this to be false by default, and for those who want monitoring, they enable it via monitoring.enabled.

## Settings for whether to disable the drivers or other daemons if they are not
## needed
csi:
Expand Down
67 changes: 67 additions & 0 deletions deploy/examples/common.yaml
View file
Open in desktop
Expand Up @@ -876,6 +876,43 @@ rules:
verbs:
- delete
---
# ---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: rook-ceph-monitoring
namespace: rook-ceph # namespace:cluster
rules:
- apiGroups:
- "monitoring.coreos.com"
resources:
- servicemonitors
- prometheusrules
verbs:
- get
- list
- watch
- create
- update
- delete
---
# Allow management of monitoring resources in the mgr
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: rook-ceph-monitoring-mgr
namespace: rook-ceph # namespace:cluster
rules:
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- list
- create
- update
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
Expand Down Expand Up @@ -1093,6 +1130,36 @@ subjects:
name: rook-ceph-mgr
namespace: rook-ceph # namespace:cluster
---
# Allow the operator to get ServiceMonitors in this cluster's namespace
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: rook-ceph-monitoring
namespace: rook-ceph # namespace:cluster
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: rook-ceph-monitoring
subjects:
- kind: ServiceAccount
name: rook-ceph-system
namespace: rook-ceph # namespace:cluster
---
# Allow creation of monitoring resources in the mgr
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: rook-ceph-monitoring-mgr
namespace: rook-ceph # namespace:cluster
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: rook-ceph-monitoring-mgr
subjects:
- kind: ServiceAccount
name: rook-ceph-mgr
namespace: rook-ceph # namespace:cluster
---
# Allow the osd pods in this namespace to work with configmaps
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
Expand Down