Merge branch 'cleanup-role' into 'master'

[RBAC] cleanup redundant and invalid Role permissions See merge request nvidia/kubernetes/gpu-operator!1086
NVIDIA · May 31, 2024 · 58afc29 · 58afc29
2 parents a003b1e + 1473ff6
commit 58afc29
Show file tree

Hide file tree

Showing 24 changed files with 6 additions and 294 deletions.
diff --git a/assets/gpu-feature-discovery/0200_role.yaml b/assets/gpu-feature-discovery/0200_role.yaml
@@ -12,11 +12,3 @@ rules:
   - use
   resourceNames:
   - privileged
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
diff --git a/assets/state-device-plugin/0200_role.yaml b/assets/state-device-plugin/0200_role.yaml
@@ -12,11 +12,3 @@ rules:
   - use
   resourceNames:
   - privileged
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
diff --git a/assets/state-driver/0200_role.yaml b/assets/state-driver/0200_role.yaml
@@ -12,20 +12,3 @@ rules:
   - use
   resourceNames:
   - privileged
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
diff --git a/assets/state-mig-manager/0200_role.yaml b/assets/state-mig-manager/0200_role.yaml
@@ -16,6 +16,5 @@ rules:
   - ""
   resources:
   - pods
-  - nodes
   verbs:
   - '*'
diff --git a/assets/state-mps-control-daemon/0200_role.yaml b/assets/state-mps-control-daemon/0200_role.yaml
@@ -12,12 +12,3 @@ rules:
   - use
   resourceNames:
   - privileged
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
-
diff --git a/assets/state-node-status-exporter/0200_role.yaml b/assets/state-node-status-exporter/0200_role.yaml
@@ -16,7 +16,6 @@ rules:
   - ""
   resources:
   - pods
-  - nodes
   verbs:
   - get
   - list
diff --git a/assets/state-operator-validation/0200_role.yaml b/assets/state-operator-validation/0200_role.yaml
@@ -16,7 +16,6 @@ rules:
   - ""
   resources:
   - pods
-  - nodes
   verbs:
   - '*'
 - apiGroups:
@@ -26,9 +25,3 @@ rules:
   - daemonsets
   verbs:
   - '*'
-- apiGroups:
-  - nvidia.com
-  resources:
-  - clusterpolicies/finalizers
-  verbs:
-  - '*'
diff --git a/assets/state-sandbox-device-plugin/0200_role.yaml b/assets/state-sandbox-device-plugin/0200_role.yaml
@@ -12,11 +12,3 @@ rules:
   - use
   resourceNames:
   - privileged
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - "get"
diff --git a/assets/state-sandbox-validation/0200_role.yaml b/assets/state-sandbox-validation/0200_role.yaml
@@ -12,9 +12,3 @@ rules:
   - use
   resourceNames:
   - privileged
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
diff --git a/assets/state-vgpu-manager/0200_role.yaml b/assets/state-vgpu-manager/0200_role.yaml
@@ -12,11 +12,3 @@ rules:
   - use
   resourceNames:
   - privileged
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - "get"
diff --git a/assets/state-vgpu-manager/0210_clusterrole.yaml b/assets/state-vgpu-manager/0210_clusterrole.yaml
@@ -20,3 +20,9 @@ rules:
   - list
   - patch
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods/eviction
+  verbs:
+  - get
diff --git a/internal/state/testdata/golden/driver-additional-configs.yaml b/internal/state/testdata/golden/driver-additional-configs.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-full-spec.yaml b/internal/state/testdata/golden/driver-full-spec.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-gdrcopy-openshift.yaml b/internal/state/testdata/golden/driver-gdrcopy-openshift.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-gdrcopy.yaml b/internal/state/testdata/golden/driver-gdrcopy.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-gds.yaml b/internal/state/testdata/golden/driver-gds.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-minimal.yaml b/internal/state/testdata/golden/driver-minimal.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-openshift-drivertoolkit.yaml b/internal/state/testdata/golden/driver-openshift-drivertoolkit.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-precompiled.yaml b/internal/state/testdata/golden/driver-precompiled.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-rdma-hostmofed.yaml b/internal/state/testdata/golden/driver-rdma-hostmofed.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-rdma.yaml b/internal/state/testdata/golden/driver-rdma.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/internal/state/testdata/golden/driver-vgpu-host-manager.yaml b/internal/state/testdata/golden/driver-vgpu-host-manager.yaml
@@ -18,23 +18,6 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/eviction
-  - nodes
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole