diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 6c47f8ec7..db3cd3dbc 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -177,7 +177,6 @@ rules: - security.openshift.io resourceNames: - anyuid - - privileged resources: - securitycontextconstraints verbs: @@ -191,18 +190,3 @@ rules: - list - update - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: manager-role - namespace: openstack -rules: -- apiGroups: - - security.openshift.io - resourceNames: - - privileged - resources: - - securitycontextconstraints - verbs: - - use diff --git a/internal/controller/manila_controller.go b/internal/controller/manila_controller.go index 2ed77841d..0734c0414 100644 --- a/internal/controller/manila_controller.go +++ b/internal/controller/manila_controller.go @@ -120,7 +120,7 @@ func (r *ManilaReconciler) GetLogger(ctx context.Context) logr.Logger { // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch // service account permissions that are needed to grant permission to the above -// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged,resources=securitycontextconstraints,verbs=use +// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use // +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch // Reconcile - @@ -551,7 +551,7 @@ func (r *ManilaReconciler) reconcileNormal(ctx context.Context, instance *manila rbacRules := []rbacv1.PolicyRule{ { APIGroups: []string{"security.openshift.io"}, - ResourceNames: []string{"anyuid", "privileged"}, + ResourceNames: []string{"anyuid"}, Resources: []string{"securitycontextconstraints"}, Verbs: []string{"use"}, }, diff --git a/internal/controller/manilashare_controller.go b/internal/controller/manilashare_controller.go index 76a50ec7b..ec4d61279 100644 --- a/internal/controller/manilashare_controller.go +++ b/internal/controller/manilashare_controller.go @@ -90,7 +90,6 @@ func (r *ManilaShareReconciler) GetLogger(ctx context.Context) logr.Logger { // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list; // +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;create;update;patch;delete;watch -// +kubebuilder:rbac:groups=security.openshift.io,namespace=openstack,resources=securitycontextconstraints,resourceNames=privileged,verbs=use // +kubebuilder:rbac:groups=k8s.cni.cncf.io,resources=network-attachment-definitions,verbs=get;list;watch // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update diff --git a/internal/manila/funcs.go b/internal/manila/funcs.go index b49d35060..3f5b328f3 100644 --- a/internal/manila/funcs.go +++ b/internal/manila/funcs.go @@ -40,9 +40,6 @@ func manilaDefaultSecurityContext() *corev1.SecurityContext { "ALL", }, }, - SeccompProfile: &corev1.SeccompProfile{ - Type: corev1.SeccompProfileTypeRuntimeDefault, - }, } } diff --git a/internal/manila/volumes.go b/internal/manila/volumes.go index affb2b964..c0fd4a117 100644 --- a/internal/manila/volumes.go +++ b/internal/manila/volumes.go @@ -14,14 +14,6 @@ func GetVolumes(name string, extraVol []manilav1.ManilaExtraVolMounts, svc []sto var config0644AccessMode int32 = 0644 res := []corev1.Volume{ - { - Name: "etc-machine-id", - VolumeSource: corev1.VolumeSource{ - HostPath: &corev1.HostPathVolumeSource{ - Path: "/etc/machine-id", - }, - }, - }, { Name: "scripts", VolumeSource: corev1.VolumeSource{ @@ -60,11 +52,6 @@ func GetVolumes(name string, extraVol []manilav1.ManilaExtraVolMounts, svc []sto // GetVolumeMounts - Nova Control Plane VolumeMounts func GetVolumeMounts(extraVol []manilav1.ManilaExtraVolMounts, svc []storage.PropagationType) []corev1.VolumeMount { res := []corev1.VolumeMount{ - { - Name: "etc-machine-id", - MountPath: "/etc/machine-id", - ReadOnly: true, - }, { Name: "config-data", MountPath: "/var/lib/config-data/default", diff --git a/test/functional/manila_controller_test.go b/test/functional/manila_controller_test.go index e33e87a44..8cf2418e3 100644 --- a/test/functional/manila_controller_test.go +++ b/test/functional/manila_controller_test.go @@ -677,7 +677,7 @@ var _ = Describe("Manila controller", func() { // Check the resulting deployment fieldsq Expect(int(*d.Spec.Replicas)).To(Equal(1)) - Expect(d.Spec.Template.Spec.Volumes).To(HaveLen(8)) + Expect(d.Spec.Template.Spec.Volumes).To(HaveLen(7)) Expect(d.Spec.Template.Spec.Containers).To(HaveLen(2)) // cert deployment volumes @@ -1268,13 +1268,13 @@ var _ = Describe("Manila controller", func() { ss := th.GetStatefulSet(share) // Check the resulting deployment fields Expect(int(*ss.Spec.Replicas)).To(Equal(1)) - Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(5)) + Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4)) Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2)) // Get the manila-share container container := ss.Spec.Template.Spec.Containers[1] // Fail if manila-share doesn't have the right number of // VolumeMounts entries - Expect(container.VolumeMounts).To(HaveLen(7)) + Expect(container.VolumeMounts).To(HaveLen(6)) // Inspect VolumeMounts and make sure we have the Ceph MountPath // provided through extraMounts th.AssertVolumeMountPathExists(ManilaCephExtraMountsSecretName, diff --git a/test/functional/manilaapi_controller_test.go b/test/functional/manilaapi_controller_test.go index 7ec1baf10..996b4b2a2 100644 --- a/test/functional/manilaapi_controller_test.go +++ b/test/functional/manilaapi_controller_test.go @@ -135,11 +135,11 @@ var _ = Describe("ManilaAPI controller", func() { ss := th.GetStatefulSet(manilaTest.ManilaAPI) // Check the resulting deployment fields Expect(int(*ss.Spec.Replicas)).To(Equal(1)) - Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(5)) + Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4)) Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2)) container := ss.Spec.Template.Spec.Containers[1] - Expect(container.VolumeMounts).To(HaveLen(7)) + Expect(container.VolumeMounts).To(HaveLen(6)) Expect(container.Image).To(Equal(manilaTest.ContainerImage)) Expect(container.LivenessProbe.HTTPGet.Port.IntVal).To(Equal(int32(8786))) Expect(container.ReadinessProbe.HTTPGet.Port.IntVal).To(Equal(int32(8786))) diff --git a/test/functional/manilascheduler_controller_test.go b/test/functional/manilascheduler_controller_test.go index af3069632..82fafa92a 100644 --- a/test/functional/manilascheduler_controller_test.go +++ b/test/functional/manilascheduler_controller_test.go @@ -136,11 +136,11 @@ var _ = Describe("ManilaScheduler controller", func() { ss := th.GetStatefulSet(manilaTest.ManilaScheduler) // Check the resulting deployment fields Expect(int(*ss.Spec.Replicas)).To(Equal(1)) - Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4)) + Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(3)) Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2)) container := ss.Spec.Template.Spec.Containers[1] - Expect(container.VolumeMounts).To(HaveLen(6)) + Expect(container.VolumeMounts).To(HaveLen(5)) Expect(container.Image).To(Equal(manilaTest.ContainerImage)) }) It("stored the input hash in the Status", func() { diff --git a/test/functional/manilashare_controller_test.go b/test/functional/manilashare_controller_test.go index 5c3f3095a..edbbea795 100644 --- a/test/functional/manilashare_controller_test.go +++ b/test/functional/manilashare_controller_test.go @@ -149,11 +149,11 @@ var _ = Describe("ManilaShare controller", func() { ss := th.GetStatefulSet(share) // Check the resulting deployment fields Expect(int(*ss.Spec.Replicas)).To(Equal(1)) - Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(4)) + Expect(ss.Spec.Template.Spec.Volumes).To(HaveLen(3)) Expect(ss.Spec.Template.Spec.Containers).To(HaveLen(2)) container := ss.Spec.Template.Spec.Containers[1] - Expect(container.VolumeMounts).To(HaveLen(6)) + Expect(container.VolumeMounts).To(HaveLen(5)) Expect(container.Image).To(Equal(manilaTest.ContainerImage)) // the input hash is stored in the current manilaShare.Status diff --git a/test/kuttl/tests/manila-tls/03-assert.yaml b/test/kuttl/tests/manila-tls/03-assert.yaml index 6e5b8d1f3..b639c2146 100644 --- a/test/kuttl/tests/manila-tls/03-assert.yaml +++ b/test/kuttl/tests/manila-tls/03-assert.yaml @@ -267,9 +267,6 @@ spec: command: - /usr/bin/dumb-init volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - readOnly: true - mountPath: /var/lib/config-data/default name: config-data - mountPath: /usr/local/bin/container-scripts @@ -307,9 +304,6 @@ spec: readOnly: true subPath: tls.key volumes: - - name: etc-machine-id - hostPath: - path: /etc/machine-id - name: scripts secret: secretName: manila-scripts @@ -362,8 +356,6 @@ spec: command: - /usr/bin/dumb-init volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - mountPath: /var/lib/config-data/default name: config-data readOnly: true @@ -393,8 +385,6 @@ spec: - share - /etc/manila/manila.conf.d volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - mountPath: /var/lib/config-data/default name: config-data readOnly: true @@ -420,9 +410,6 @@ spec: readOnly: true subPath: tls-ca-bundle.pem volumes: - - name: etc-machine-id - hostPath: - path: /etc/machine-id - name: scripts secret: secretName: manila-scripts @@ -467,8 +454,6 @@ spec: command: - /usr/bin/dumb-init volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - mountPath: /var/lib/config-data/default name: config-data readOnly: true @@ -495,9 +480,6 @@ spec: - scheduler - /etc/manila/manila.conf.d volumeMounts: - - mountPath: /etc/machine-id - name: etc-machine-id - readOnly: true - mountPath: /var/lib/config-data/default name: config-data readOnly: true @@ -520,9 +502,6 @@ spec: readOnly: true subPath: tls-ca-bundle.pem volumes: - - name: etc-machine-id - hostPath: - path: /etc/machine-id - name: scripts secret: secretName: manila-scripts