[occm] Reduce ClusterRole scope (#3165)

* [occm] Limit verbs for node access

OCCM does not need to create or delete nodes

Signed-off-by: Stephen Finucane <stephenfin@redhat.com>

* [occm] Prevent access to PVs

OCCM does not need this access.

Signed-off-by: Stephen Finucane <stephenfin@redhat.com>

* [occm] Add new Role for secrets

OCCM does not query Kubernetes secrets via the Kubernetes API in any of
its controllers. The only secret is needs access to is the
'cloud-config' secret mounted as a volume into the container. This
exists in the 'kube-system' namespace for standard manifests and the
release namespace when deployed via Helm. Therefore it's unnecessary to
grand cluster-wide get, list and watch access to all secrets via the
system:cloud-controller-manager ClusterRole.

Fix this by introducing a new
'system:cloud-controller-manager:secret-reader' Role in the standard
manifests and a '{{ .Values.clusterRoleName }}:secret-reader' Role in
the Helm charts.

Signed-off-by: Stephen Finucane <stephenfin@redhat.com>

* occm: Bump openstack-cloud-controller-manager chart to 2.36.2

Signed-off-by: Stephen Finucane <stephenfin@redhat.com>

---------

Signed-off-by: Stephen Finucane <stephenfin@redhat.com>

Author: stephenfin

charts/openstack-cloud-controller-manager/Chart.yaml

@@ -4,7 +4,7 @@ description: Openstack Cloud Controller Manager Helm Chart
 icon: https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-images-prod/openstack-logo/OpenStack-Logo-Vertical.png
 home: https://github.com/kubernetes/cloud-provider-openstack
 name: openstack-cloud-controller-manager
-version: 2.36.1
+version: 2.36.2
 maintainers:
   - name: eumel8
     email: f.kloeker@telekom.de

charts/openstack-cloud-controller-manager/templates/clusterrole.yaml

@@ -29,7 +29,11 @@ rules:
   resources:
   - nodes
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - patch
+  - update
 - apiGroups:
   - ""
   resources:
@@ -64,12 +68,6 @@ rules:
   verbs:
   - create
   - get
-- apiGroups:
-  - ""
-  resources:
-  - persistentvolumes
-  verbs:
-  - '*'
 - apiGroups:
   - ""
   resources:
@@ -88,11 +86,3 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - list
-  - get
-  - watch

charts/openstack-cloud-controller-manager/templates/role.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.secret.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Values.clusterRoleName }}:secret-reader
+  namespace: {{ .Release.Namespace }}
+  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  annotations:
+    {{- with .Values.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  resourceNames:
+  - {{ .Values.secret.name | default "cloud-config" }}
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}

charts/openstack-cloud-controller-manager/templates/rolebinding.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.secret.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Values.clusterRoleName }}:secret-reader
+  namespace: {{ .Release.Namespace }}
+  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  annotations:
+    {{- with .Values.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Values.clusterRoleName }}:secret-reader
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.serviceAccountName }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

manifests/controller-manager/cloud-controller-manager-role-bindings.yaml

@@ -24,5 +24,18 @@ items:
   - kind: ServiceAccount
     name: cloud-controller-manager
     namespace: kube-system
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: RoleBinding
+  metadata:
+    name: system:cloud-controller-manager:secret-reader
+    namespace: kube-system
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: system:cloud-controller-manager:secret-reader
+  subjects:
+  - kind: ServiceAccount
+    name: cloud-controller-manager
+    namespace: kube-system
 kind: List
 metadata: {}

manifests/controller-manager/cloud-controller-manager-roles.yaml

@@ -26,7 +26,11 @@ items:
     resources:
     - nodes
     verbs:
-    - '*'
+    - get
+    - list
+    - watch
+    - patch
+    - update
   - apiGroups:
     - ""
     resources:
@@ -61,12 +65,6 @@ items:
     - serviceaccounts/token
     verbs:
     - create
-  - apiGroups:
-    - ""
-    resources:
-    - persistentvolumes
-    verbs:
-    - '*'
   - apiGroups:
     - ""
     resources:
@@ -85,13 +83,21 @@ items:
     - get
     - list
     - watch
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: Role
+  metadata:
+    name: system:cloud-controller-manager:secret-reader
+    namespace: kube-system
+  rules:
   - apiGroups:
     - ""
     resources:
     - secrets
+    resourceNames:
+    - cloud-config
     verbs:
-    - list
     - get
+    - list
     - watch
 - apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole