remove unneeded permissions for volume controllers #125995

carlory · 2024-07-10T09:57:41Z

What type of PR is this?

/kind bug

What this PR does / why we need it:

the glusterfs and OpenStack volume plugins have been removed from the in-tree.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

 Removed unneeded permissions for system:controller:persistent-volume-binder and system:controller:expand-controller clusterroles

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot · 2024-07-10T09:57:49Z

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

carlory · 2024-07-10T09:58:26Z

/cc @xing-yang @jsafrane @msau42

For storage review

carlory · 2024-07-10T10:03:45Z

/sig storage

carlory · 2024-07-10T10:20:02Z

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go

@@ -286,14 +282,7 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
 			rbacv1helpers.NewRule("get", "list", "watch", "update").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(),
 			rbacv1helpers.NewRule("update").Groups(legacyGroup).Resources("persistentvolumeclaims/status").RuleOrDie(),
 			rbacv1helpers.NewRule("list", "watch", "get", "create", "delete").Groups(legacyGroup).Resources("pods").RuleOrDie(),
-
-			// glusterfs
 			rbacv1helpers.NewRule("get", "list", "watch").Groups(storageGroup).Resources("storageclasses").RuleOrDie(),


The PV controller requires storageclass permissions, so keep it.

do you have a link to this? knowing how you audited what was still in use would help build confidence that the other things being removed from this role are not in use by the controller in some other way

PV controller: https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/volume/persistentvolume/pv_controller_base.go#L63

informers: pv, pvc, sc, pod, node (list, watch)

It is so strange that persistent-volume-binder clusterrole doesn't contain the watch verb for node resource. And the list verb is added in the openstack section. @jsafrane @msau42 @liggitt should I add the watch and list verb for node resource in the persistent-volume-binder clusterrole?

And the sc permission is added in the glusterfs section.

kubeClient: pv (get, update), pvc (get, update)

others: event

volume plugins:

kubernetes/cmd/kube-controller-manager/app/plugins.go

Line 82 in beb696c

func ProbeControllerVolumePlugins(logger klog.Logger, config persistentvolumeconfig.VolumeConfiguration) ([]volume.VolumePlugin, error) {

used to provision/reclaim the volume.

hostpath:

recycler: https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/hostpath/host_path.go#L156 (kube client)

deleter: https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/hostpath/host_path.go#L354 (no kube client used)

provisioner: https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/hostpath/host_path.go#L293 (no kube client used)

nfs:

recycler: https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/nfs/nfs.go#L156 (kube client)

portworx:

deleter: https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/portworx/portworx.go#L383 (use kube client to get service when it delete the volume https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/portworx/portworx_util.go#L289)

provisioner: https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/portworx/portworx.go#L394 (use kube client to get service when it create the volume https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/portworx/portworx_util.go#L289)
These volume plugins doesn't access to endpoints and nodes resources. I can't find the code that it uses kube client to access the specific resource.

expand controller: https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/volume/expand/expand_controller.go#L100

informers: pvc (list, watch)

kubeClient: pv (get)

kubernetes/pkg/controller/volume/expand/expand_controller.go

Line 349 in beb696c

pv, err := expc.kubeClient.CoreV1().PersistentVolumes().Get(ctx, volumeName, metav1.GetOptions{})

others: event

volume plugins: https://github.com/kubernetes/kubernetes/blob/master/cmd/kube-controller-manager/app/plugins.go#L68 used to expand the volume.

portworx:

expander: https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/portworx/portworx.go#L204 (use kube client to get service when it expand the volume https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/portworx/portworx_util.go#L289)

And the get verb for service is added in the glusterfs section.

fc: it doesn't implement the expander interface.
These volume plugins doesn't access to endpoints, storageclasses and secrets resources. I can't find the code that it uses kube client to access the specific resource.

@jsafrane @liggitt can you review it again? I pushed some changes.

I'd like storage folks to do the first pass review here since they have domain knowledge of the controller loops

I went through the PR and I can see that it removes bunch of unneeded permissions of removed volume plugins.

About the selected line here (read storageclasses), the PV controller needs to find a CSI driver / provisioner responsible for provisioning of a PVC. It is not a feature related to Gluster, the comment is wrong.

/hold cancel

Thanks a lot.

/cc @liggitt

Please review it again.

@jsafrane do we have test coverage that would notice if we dropped a permission here that was actually still required?

carlory · 2024-07-10T11:15:09Z

/test pull-kubernetes-e2e-gce

jsafrane · 2024-07-22T11:23:37Z

/lgtm
/approve

k8s-ci-robot · 2024-07-22T11:23:44Z

LGTM label has been added.

Git tree hash: 238fa31f813576e9fbc274fa953bb19355f04bce

carlory · 2024-07-22T11:32:26Z

/assign @mikedanese

carlory · 2024-08-15T10:25:27Z

/cc @liggitt

Can you take a look?

…inder and system:controller:expand-controller clusterroles

carlory · 2024-08-21T04:17:46Z

the AD controller supports the flexVolume plugin.

https://github.com/kubernetes/kubernetes/blob/remove-unnecessary-permissions/pkg/controller/volume/attachdetach/attach_detach_controller.go#L117

The flexVolume plugin implements the ExpandableVolumePlugin interface, but the expander controller does not add support for it.

Is it a bug? the flexVolume plugin has been marked as deprecated since v1.23, but it still works. I don't know whether it is worth to fix it. @jsafrane

carlory · 2024-08-21T07:41:13Z

#67851 implemented the Flexvolume resize and said that the flex plugins are not installed on the controller.

the flex plugin implements the ExpandableVolumePlugin interface, which component is responsible for calling the ExpandVolumeDevice method of the flex plugin? kubelet?

// ExpandableVolumePlugin is an extended interface of VolumePlugin and is used for volumes that can be
// expanded via control-plane ExpandVolumeDevice call.
type ExpandableVolumePlugin interface {
	VolumePlugin
	ExpandVolumeDevice(spec *Spec, newSize resource.Quantity, oldSize resource.Quantity) (resource.Quantity, error)
	RequiresFSResize() bool
}

I'm wondering if the flex plugins are not installed on the master, why the ADC needs to probe volume plugins dynamically?

If we don't add the flex plugins to the expand controller, once the portwox plugin completes csi migration, can we deprecated the expand controller and remove it in the future? @aniket-s-kulkarni @gnufied

gnufied · 2024-08-22T16:35:03Z

/assign

gnufied · 2024-08-22T18:09:54Z

@carlory can you file a separate issue about deprecation and removal of expand_controller from intree code? The flex volume plugin IMO does support allowing expansion from control-plane too. It is just that, most deployments typically don't install the flex volume plugin in the control-plane for various reasons, but if they do and plugin implements expandvolume command, then control-plane expansion will work.

I'm wondering if the flex plugins are not installed on the master, why the ADC needs to probe volume plugins dynamically?

Node only deployment is now the only way to deploy flex. Flex plugin also optionally supports attach which can be executed from control-plane.

carlory · 2024-08-23T06:33:20Z

can you file a separate issue about deprecation and removal of expand_controller from intree code?

#126881 cc @gnufied

jsafrane · 2024-09-17T12:59:30Z

/lgtm

k8s-ci-robot · 2024-09-17T12:59:37Z

LGTM label has been added.

Git tree hash: d2b293971a2e546f1647150118f60c8a48a091ad

liggitt · 2024-09-19T16:06:11Z

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go

@@ -188,11 +188,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
 			rbacv1helpers.NewRule("get", "list", "watch", "update", "patch").Groups(legacyGroup).Resources("persistentvolumes").RuleOrDie(),
 			rbacv1helpers.NewRule("update", "patch").Groups(legacyGroup).Resources("persistentvolumeclaims/status").RuleOrDie(),
 			rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(),
-			// glusterfs


is there an out of tree CSI gluster controller now? does it deploy its own role/rolebindings to grant required permissions or reference this default role? do we need to open an issue to update the manifest there to add these removed permissions?

About the selected line here (read storageclasses), the PV controller needs to find a CSI driver / provisioner responsible for provisioning of a PVC. It is not a feature related to Gluster, the comment is wrong.

@jsafrane does this also apply to the expand controller? (does it need storageclass read permission independent of glusterfs?)

I am not sure if there is a supported glusterfs csi driver currently. The driver Google shows is deprecated - https://github.com/gluster/gluster-csi-driver

But yes, the permissions associated with expand-controller which was given here for intree glusterfs driver shouldn't matter, any external CSI driver should run with its own serviceaccount and permissions.

(does it need storageclass read permission independent of glusterfs?)

It shouldn't. The only other place we do read storageclasses for expansion purposes (apart from external-resizer which runs with its own permissions), is for admission - https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/admission/storage/persistentvolume/resize/admission.go#L62

But that code shouldn't run with permissions specified in here. So, we should be fine. I triggered alpha test suite just in case, because it has more of expansion related tests to be sure.

liggitt · 2024-09-19T16:08:47Z

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go

@@ -188,11 +188,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
 			rbacv1helpers.NewRule("get", "list", "watch", "update", "patch").Groups(legacyGroup).Resources("persistentvolumes").RuleOrDie(),
 			rbacv1helpers.NewRule("update", "patch").Groups(legacyGroup).Resources("persistentvolumeclaims/status").RuleOrDie(),
 			rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(),
-			// glusterfs


About the selected line here (read storageclasses), the PV controller needs to find a CSI driver / provisioner responsible for provisioning of a PVC. It is not a feature related to Gluster, the comment is wrong.

@jsafrane does this also apply to the expand controller? (does it need storageclass read permission independent of glusterfs?)

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go

liggitt · 2024-09-19T16:32:42Z

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go

@@ -286,14 +282,7 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
 			rbacv1helpers.NewRule("get", "list", "watch", "update").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(),
 			rbacv1helpers.NewRule("update").Groups(legacyGroup).Resources("persistentvolumeclaims/status").RuleOrDie(),
 			rbacv1helpers.NewRule("list", "watch", "get", "create", "delete").Groups(legacyGroup).Resources("pods").RuleOrDie(),
-
-			// glusterfs
 			rbacv1helpers.NewRule("get", "list", "watch").Groups(storageGroup).Resources("storageclasses").RuleOrDie(),


@jsafrane do we have test coverage that would notice if we dropped a permission here that was actually still required?

gnufied · 2024-09-19T19:24:17Z

/test gce-cos-master-alpha-features

k8s-ci-robot · 2024-09-19T19:24:20Z

@gnufied: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-cos-containerd-e2e-ubuntu-gce
/test pull-kubernetes-conformance-kind-ga-only-parallel
/test pull-kubernetes-coverage-unit
/test pull-kubernetes-dependencies
/test pull-kubernetes-dependencies-go-canary
/test pull-kubernetes-e2e-gce
/test pull-kubernetes-e2e-gce-100-performance
/test pull-kubernetes-e2e-gce-cos
/test pull-kubernetes-e2e-gce-cos-canary
/test pull-kubernetes-e2e-gce-cos-no-stage
/test pull-kubernetes-e2e-gce-network-proxy-http-connect
/test pull-kubernetes-e2e-gce-pull-through-cache
/test pull-kubernetes-e2e-kind
/test pull-kubernetes-e2e-kind-ipv6
/test pull-kubernetes-integration
/test pull-kubernetes-integration-go-canary
/test pull-kubernetes-kubemark-e2e-gce-scale
/test pull-kubernetes-node-e2e-containerd
/test pull-kubernetes-typecheck
/test pull-kubernetes-unit
/test pull-kubernetes-unit-go-canary
/test pull-kubernetes-update
/test pull-kubernetes-verify
/test pull-kubernetes-verify-go-canary
/test pull-kubernetes-verify-lint

The following commands are available to trigger optional jobs:

/test check-dependency-stats
/test pull-crio-cgroupv1-node-e2e-eviction
/test pull-crio-cgroupv1-node-e2e-features
/test pull-crio-cgroupv1-node-e2e-hugepages
/test pull-crio-cgroupv1-node-e2e-resource-managers
/test pull-crio-cgroupv2-imagefs-separatedisktest
/test pull-crio-cgroupv2-node-e2e-eviction
/test pull-crio-cgroupv2-node-e2e-hugepages
/test pull-crio-cgroupv2-node-e2e-resource-managers
/test pull-crio-cgroupv2-splitfs-separate-disk
/test pull-e2e-gce-cloud-provider-disabled
/test pull-e2e-gci-gce-alpha-enabled-default
/test pull-kubernetes-apidiff
/test pull-kubernetes-conformance-image-test
/test pull-kubernetes-conformance-kind-ga-only
/test pull-kubernetes-conformance-kind-ipv6-parallel
/test pull-kubernetes-cos-cgroupv1-containerd-node-e2e
/test pull-kubernetes-cos-cgroupv1-containerd-node-e2e-features
/test pull-kubernetes-cos-cgroupv2-containerd-node-e2e
/test pull-kubernetes-cos-cgroupv2-containerd-node-e2e-eviction
/test pull-kubernetes-cos-cgroupv2-containerd-node-e2e-features
/test pull-kubernetes-cos-cgroupv2-containerd-node-e2e-serial
/test pull-kubernetes-crio-node-memoryqos-cgrpv2
/test pull-kubernetes-cross
/test pull-kubernetes-e2e-autoscaling-hpa-cm
/test pull-kubernetes-e2e-autoscaling-hpa-cpu
/test pull-kubernetes-e2e-capz-azure-disk
/test pull-kubernetes-e2e-capz-azure-disk-vmss
/test pull-kubernetes-e2e-capz-azure-file
/test pull-kubernetes-e2e-capz-azure-file-vmss
/test pull-kubernetes-e2e-capz-conformance
/test pull-kubernetes-e2e-capz-master-windows-nodelogquery
/test pull-kubernetes-e2e-capz-windows-alpha-feature-vpa
/test pull-kubernetes-e2e-capz-windows-alpha-features
/test pull-kubernetes-e2e-capz-windows-master
/test pull-kubernetes-e2e-capz-windows-serial-slow
/test pull-kubernetes-e2e-capz-windows-serial-slow-hpa
/test pull-kubernetes-e2e-containerd-gce
/test pull-kubernetes-e2e-ec2
/test pull-kubernetes-e2e-ec2-arm64
/test pull-kubernetes-e2e-ec2-conformance
/test pull-kubernetes-e2e-ec2-conformance-arm64
/test pull-kubernetes-e2e-ec2-device-plugin-gpu
/test pull-kubernetes-e2e-gce-canary
/test pull-kubernetes-e2e-gce-correctness
/test pull-kubernetes-e2e-gce-cos-alpha-features
/test pull-kubernetes-e2e-gce-csi-serial
/test pull-kubernetes-e2e-gce-device-plugin-gpu
/test pull-kubernetes-e2e-gce-disruptive-canary
/test pull-kubernetes-e2e-gce-kubelet-credential-provider
/test pull-kubernetes-e2e-gce-network-policies
/test pull-kubernetes-e2e-gce-network-proxy-grpc
/test pull-kubernetes-e2e-gce-serial
/test pull-kubernetes-e2e-gce-serial-canary
/test pull-kubernetes-e2e-gce-storage-disruptive
/test pull-kubernetes-e2e-gce-storage-selinux
/test pull-kubernetes-e2e-gce-storage-slow
/test pull-kubernetes-e2e-gce-storage-snapshot
/test pull-kubernetes-e2e-gci-gce-autoscaling
/test pull-kubernetes-e2e-gci-gce-ingress
/test pull-kubernetes-e2e-gci-gce-ipvs
/test pull-kubernetes-e2e-gci-gce-nftables
/test pull-kubernetes-e2e-inplace-pod-resize-containerd-main-v2
/test pull-kubernetes-e2e-kind-alpha-beta-features
/test pull-kubernetes-e2e-kind-alpha-features
/test pull-kubernetes-e2e-kind-beta-features
/test pull-kubernetes-e2e-kind-canary
/test pull-kubernetes-e2e-kind-cloud-provider-loadbalancer
/test pull-kubernetes-e2e-kind-dual-canary
/test pull-kubernetes-e2e-kind-evented-pleg
/test pull-kubernetes-e2e-kind-ipv6-canary
/test pull-kubernetes-e2e-kind-kms
/test pull-kubernetes-e2e-kind-multizone
/test pull-kubernetes-e2e-kind-nftables
/test pull-kubernetes-e2e-storage-kind-alpha-beta-features
/test pull-kubernetes-e2e-storage-kind-disruptive
/test pull-kubernetes-kind-classic-dra
/test pull-kubernetes-kind-dra
/test pull-kubernetes-kind-json-logging
/test pull-kubernetes-kind-text-logging
/test pull-kubernetes-kubemark-e2e-gce-big
/test pull-kubernetes-linter-hints
/test pull-kubernetes-local-e2e
/test pull-kubernetes-node-arm64-e2e-containerd-ec2
/test pull-kubernetes-node-arm64-e2e-containerd-serial-ec2
/test pull-kubernetes-node-arm64-ubuntu-serial-gce
/test pull-kubernetes-node-crio-cgrpv1-evented-pleg-e2e
/test pull-kubernetes-node-crio-cgrpv2-e2e
/test pull-kubernetes-node-crio-cgrpv2-e2e-kubetest2
/test pull-kubernetes-node-crio-cgrpv2-imagefs-e2e
/test pull-kubernetes-node-crio-cgrpv2-imagevolume-e2e
/test pull-kubernetes-node-crio-cgrpv2-splitfs-e2e
/test pull-kubernetes-node-crio-cgrpv2-userns-e2e
/test pull-kubernetes-node-crio-e2e
/test pull-kubernetes-node-crio-e2e-kubetest2
/test pull-kubernetes-node-e2e-alpha-ec2
/test pull-kubernetes-node-e2e-containerd-1-7-dra
/test pull-kubernetes-node-e2e-containerd-alpha-features
/test pull-kubernetes-node-e2e-containerd-ec2
/test pull-kubernetes-node-e2e-containerd-features
/test pull-kubernetes-node-e2e-containerd-features-kubetest2
/test pull-kubernetes-node-e2e-containerd-kubetest2
/test pull-kubernetes-node-e2e-containerd-serial-ec2
/test pull-kubernetes-node-e2e-containerd-serial-ec2-eks
/test pull-kubernetes-node-e2e-containerd-standalone-mode
/test pull-kubernetes-node-e2e-containerd-standalone-mode-all-alpha
/test pull-kubernetes-node-e2e-crio-cgrpv1-dra
/test pull-kubernetes-node-e2e-crio-cgrpv2-dra
/test pull-kubernetes-node-e2e-resource-health-status
/test pull-kubernetes-node-kubelet-containerd-flaky
/test pull-kubernetes-node-kubelet-credential-provider
/test pull-kubernetes-node-kubelet-serial-containerd
/test pull-kubernetes-node-kubelet-serial-containerd-alpha-features
/test pull-kubernetes-node-kubelet-serial-containerd-kubetest2
/test pull-kubernetes-node-kubelet-serial-containerd-sidecar-containers
/test pull-kubernetes-node-kubelet-serial-cpu-manager
/test pull-kubernetes-node-kubelet-serial-cpu-manager-kubetest2
/test pull-kubernetes-node-kubelet-serial-crio-cgroupv1
/test pull-kubernetes-node-kubelet-serial-crio-cgroupv2
/test pull-kubernetes-node-kubelet-serial-hugepages
/test pull-kubernetes-node-kubelet-serial-memory-manager
/test pull-kubernetes-node-kubelet-serial-podresize
/test pull-kubernetes-node-kubelet-serial-topology-manager
/test pull-kubernetes-node-kubelet-serial-topology-manager-kubetest2
/test pull-kubernetes-node-swap-conformance-fedora-serial
/test pull-kubernetes-node-swap-conformance-ubuntu-serial
/test pull-kubernetes-node-swap-fedora
/test pull-kubernetes-node-swap-fedora-serial
/test pull-kubernetes-node-swap-ubuntu-serial
/test pull-kubernetes-scheduler-perf
/test pull-kubernetes-unit-experimental
/test pull-publishing-bot-validate

Use /test all to run the following jobs that were automatically triggered:

pull-kubernetes-conformance-kind-ga-only-parallel
pull-kubernetes-dependencies
pull-kubernetes-e2e-ec2
pull-kubernetes-e2e-ec2-conformance
pull-kubernetes-e2e-gce
pull-kubernetes-e2e-gce-canary
pull-kubernetes-e2e-kind
pull-kubernetes-e2e-kind-ipv6
pull-kubernetes-integration
pull-kubernetes-linter-hints
pull-kubernetes-node-e2e-containerd
pull-kubernetes-typecheck
pull-kubernetes-unit
pull-kubernetes-verify
pull-kubernetes-verify-lint

In response to this:

/test gce-cos-master-alpha-features

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

gnufied · 2024-09-19T19:24:39Z

/test pull-kubernetes-e2e-gce-cos-alpha-features

liggitt · 2024-09-24T13:31:47Z

/lgtm
/approve

k8s-ci-robot · 2024-09-24T13:32:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: carlory, jsafrane, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~plugin/pkg/auth/authorizer/OWNERS~~ [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. kind/bug Categorizes issue or PR as related to a bug. labels Jul 10, 2024

k8s-ci-robot requested a review from deads2k July 10, 2024 09:57

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 10, 2024

k8s-ci-robot requested a review from wojtek-t July 10, 2024 09:57

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Jul 10, 2024

k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jul 10, 2024

k8s-ci-robot requested review from jsafrane, msau42 and xing-yang July 10, 2024 09:58

k8s-ci-robot added the sig/storage Categorizes an issue or PR as relevant to SIG Storage. label Jul 10, 2024

carlory commented Jul 10, 2024

View reviewed changes

k8s-ci-robot assigned jsafrane Jul 22, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 22, 2024

k8s-ci-robot assigned mikedanese Jul 22, 2024

k8s-ci-robot requested a review from liggitt August 15, 2024 10:25

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 21, 2024

remove unneeded permissions for system:controller:persistent-volume-b…

ae9e381

…inder and system:controller:expand-controller clusterroles

carlory force-pushed the remove-unnecessary-permissions branch from b788e76 to ae9e381 Compare August 21, 2024 04:02

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 21, 2024

k8s-ci-robot requested a review from mikedanese August 21, 2024 04:02

k8s-ci-robot assigned gnufied Aug 22, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 17, 2024

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 17, 2024

liggitt reviewed Sep 19, 2024

View reviewed changes

k8s-ci-robot assigned liggitt Sep 24, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 24, 2024

k8s-ci-robot merged commit 9571d3b into kubernetes:master Sep 24, 2024
14 of 15 checks passed

k8s-ci-robot added this to the v1.32 milestone Sep 24, 2024

carlory deleted the remove-unnecessary-permissions branch September 24, 2024 15:14

remove unneeded permissions for volume controllers #125995

remove unneeded permissions for volume controllers #125995

Conversation

carlory commented Jul 10, 2024

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot commented Jul 10, 2024

carlory commented Jul 10, 2024 • edited Loading

carlory commented Jul 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

carlory commented Jul 10, 2024

jsafrane commented Jul 22, 2024

k8s-ci-robot commented Jul 22, 2024

carlory commented Jul 22, 2024

carlory commented Aug 15, 2024

carlory commented Aug 21, 2024

carlory commented Aug 21, 2024 • edited Loading

gnufied commented Aug 22, 2024

gnufied commented Aug 22, 2024 • edited Loading

carlory commented Aug 23, 2024

jsafrane commented Sep 17, 2024

k8s-ci-robot commented Sep 17, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gnufied Sep 19, 2024 • edited Loading

Choose a reason for hiding this comment

gnufied Sep 19, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gnufied commented Sep 19, 2024

k8s-ci-robot commented Sep 19, 2024

gnufied commented Sep 19, 2024

liggitt commented Sep 24, 2024

k8s-ci-robot commented Sep 24, 2024

carlory commented Jul 10, 2024 •

edited

Loading

carlory commented Aug 21, 2024 •

edited

Loading

gnufied commented Aug 22, 2024 •

edited

Loading

gnufied Sep 19, 2024 •

edited

Loading

gnufied Sep 19, 2024 •

edited

Loading