apiVersion: v1
kind: Namespace
metadata:
  name: openshift-ovirt-csi-operator
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ovirt-csi-node-sa
  namespace: ovirt-csi-driver
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ovirt-csi-controller-sa
  namespace: ovirt-csi-driver
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ovirt-csi-controller-provisioner-binding
subjects:
  - kind: ServiceAccount
    name: ovirt-csi-controller-sa
    namespace: ovirt-csi-driver
roleRef:
  kind: ClusterRole
  name: csi-external-provisioner
  apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ovirt-csi-controller-attacher-binding
subjects:
  - kind: ServiceAccount
    name: ovirt-csi-controller-sa
    namespace: ovirt-csi-driver
roleRef:
  kind: ClusterRole
  name: csi-external-attacher
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ovirt-csi-controller-cr
rules:
  # Allow listing and creating CRDs
  - apiGroups: ['apiextensions.k8s.io']
    resources: ['customresourcedefinitions']
    verbs: ['list', 'create']
  - apiGroups: ['']
    resources: ['persistentvolumes']
    verbs: ['create', 'delete', 'get', 'list', 'watch', 'update', 'patch']
  - apiGroups: ['']
    resources: ['secrets']
    verbs: ['get', 'list']
  - apiGroups: ['']
    resources: ['persistentvolumeclaims']
    verbs: ['get', 'list', 'watch', 'update']
  - apiGroups: [""]
    resources: ["persistentvolumeclaims/status"]
    verbs: ["update", "patch"]
  - apiGroups: ['']
    resources: ['nodes']
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['storage.k8s.io']
    resources: ['volumeattachments']
    verbs: ['get', 'list', 'watch', 'update', 'patch']
  - apiGroups: ['storage.k8s.io']
    resources: ['storageclasses']
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['csi.storage.k8s.io']
    resources: ['csidrivers']
    verbs: ['get', 'list', 'watch', 'update', 'create']
  - apiGroups: ['']
    resources: ['events']
    verbs: ['list', 'watch', 'create', 'update', 'patch']
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotcontents"]
    verbs: ["create", "get", "list", "watch", "update", "delete"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots/status"]
    verbs: ["update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["csinodes"]
    verbs: ["get", "list", "watch"]
---

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ovirt-csi-node-cr
rules:
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "update", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: ["csi.storage.k8s.io"]
    resources: ["csinodeinfos"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["csinodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["volumeattachments"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["list", "watch", "create", "update", "patch"]
  - apiGroups: ["security.openshift.io"]
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
    resourceNames: ["privileged"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: openshift:csi-driver-controller-leader-election
rules:
  - apiGroups: [""]
    resources: ["configmaps", "endpoints"]
    verbs: ["get", "list", "watch", "update", "create", "delete"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ovirt-csi-controller-binding
subjects:
  - kind: ServiceAccount
    name: ovirt-csi-controller-sa
    namespace: ovirt-csi-driver
roleRef:
  kind: ClusterRole
  name: ovirt-csi-controller-cr
  apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ovirt-csi-leader-binding
subjects:
  - kind: ServiceAccount
    name: ovirt-csi-controller-sa
    namespace: ovirt-csi-driver
roleRef:
  kind: ClusterRole
  name: openshift:csi-driver-controller-leader-election
  apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ovirt-csi-node-binding
subjects:
  - kind: ServiceAccount
    name: ovirt-csi-node-sa
    namespace: ovirt-csi-driver
roleRef:
  kind: ClusterRole
  name: ovirt-csi-node-cr
  apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ovirt-csi-node-leader-binding
subjects:
  - kind: ServiceAccount
    name: ovirt-csi-node-sa
    namespace: ovirt-csi-driver
roleRef:
  kind: ClusterRole
  name: openshift:csi-driver-controller-leader-election
  apiGroup: rbac.authorization.k8s.io
---

