RBAC Security

Cluster Role

NOTE This is only needed when you are not already cluster-admin in your Kubernetes cluster!

Creating the Rook operator requires privileges for setting up RBAC. To launch the operator you need to have created your user certificate that is bound to ClusterRole cluster-admin.

One simple way to achieve it is to assign your certificate with the system:masters group:

  1. -subj "/CN=admin/O=system:masters"

system:masters is a special group that is bound to cluster-admin ClusterRole, but it can’t be easily revoked so be careful with taking that route in a production setting. Binding individual certificate to ClusterRole cluster-admin is revocable by deleting the ClusterRoleBinding.

RBAC for PodSecurityPolicies

If you have activated the PodSecurityPolicy Admission Controller and thus are using PodSecurityPolicies, you will require additional (Cluster)RoleBindings for the different ServiceAccounts Rook uses to start the Rook Storage Pods.

Note: You do not have to perform these steps if you do not have the PodSecurityPolicy Admission Controller activated!

PodSecurityPolicy

You need one PodSecurityPolicy that allows privileged Pod execution. Here is an example:

  1. apiVersion: extensions/v1beta1
  2. kind: PodSecurityPolicy
  3. metadata:
  4.   name: privileged
  5. spec:
  6.   fsGroup:
  7.     rule: RunAsAny
  8.   privileged: true
  9.   runAsUser:
  10.     rule: RunAsAny
  11.   seLinux:
  12.     rule: RunAsAny
  13.   supplementalGroups:
  14.     rule: RunAsAny
  15.   volumes:
  16.   - '*'
  17.   allowedCapabilities:
  18.   - '*'
  19.   hostPID: true
  20.   hostIPC: true
  21.   hostNetwork: false

Hint: Allowing hostNetwork usage is required when using hostNetwork: true in the Cluster CustomResourceDefinition! You are then also required to allow the usage of hostPorts in the PodSecurityPolicy. The given port range is a minimal working recommendation for a Rook Ceph cluster:

  1.    hostPorts:
  2.      # Ceph ports
  3.      - min: 6789
  4.        max: 7300
  5.      # Ceph MGR Prometheus Metrics
  6.      - min: 9283
  7.        max: 9283
ClusterRole and ClusterRoleBinding

Next up you require a ClusterRole and a corresponding ClusterRoleBinding, which enables the Rook Agent ServiceAccount to run the rook-ceph-agent Pods on all nodes with privileged rights. Here are the definitions:

  1. # privilegedPSP grants access to use the privileged PSP.
  2. apiVersion: rbac.authorization.k8s.io/v1
  3. kind: ClusterRole
  4. metadata:
  5.   name: privileged-psp-user
  6. rules:
  7. - apiGroups:
  8.   - extensions
  9.   resources:
  10.   - podsecuritypolicies
  11.   resourceNames:
  12.   - privileged
  13.   verbs:
  14.   - use

and

  1. apiVersion: v1
  2. kind: Namespace
  3. metadata:
  4.   name: rook-ceph-system
  5. ---
  6. # Allow the rook-ceph-system serviceAccount to use the privileged PSP
  7. apiVersion: rbac.authorization.k8s.io/v1
  8. kind: ClusterRoleBinding
  9. metadata:
  10.   name: rook-ceph-system-psp
  11. roleRef:
  12.   apiGroup: rbac.authorization.k8s.io
  13.   kind: ClusterRole
  14.   name: privileged-psp-user
  15. subjects:
  16. - kind: ServiceAccount
  17.   name: rook-ceph-system
  18.   namespace: rook-ceph-system

Save these definitions to one or multiple yaml files and create them by executing kubectl apply -f <nameOfYourFile>.yaml

You will also require two more RoleBindings for each Rook Cluster you deploy: Create these two RoleBindings in the Namespace you plan to deploy your Rook Cluster into (default is “rook” namespace):

  1. apiVersion: v1
  2. kind: Namespace
  3. metadata:
  4.   name: rook-ceph
  5. ---
  6. # Allow the default serviceAccount to use the privileged PSP
  7. apiVersion: rbac.authorization.k8s.io/v1
  8. kind: RoleBinding
  9. metadata:
  10.   name: rook-default-psp
  11.   namespace: rook-ceph
  12. roleRef:
  13.   apiGroup: rbac.authorization.k8s.io
  14.   kind: ClusterRole
  15.   name: privileged-psp-user
  16. subjects:
  17. - kind: ServiceAccount
  18.   name: default
  19.   namespace: rook-ceph
  20. ---
  21. # Allow the rook-ceph-osd serviceAccount to use the privileged PSP
  22. apiVersion: rbac.authorization.k8s.io/v1
  23. kind: RoleBinding
  24. metadata:
  25.   name: rook-ceph-osd-psp
  26.   namespace: rook-ceph
  27. roleRef:
  28.   apiGroup: rbac.authorization.k8s.io
  29.   kind: ClusterRole
  30.   name: privileged-psp-user
  31. subjects:
  32. - kind: ServiceAccount
  33.   name: rook-ceph-osd
  34.   namespace: rook-ceph