Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Paste
P96492
ceph-csi-cephfs
Active
Public
Actions
Authored by
atsuko
on Tue, Sep 22, 12:48 PM.
Edit Paste
Archive Paste
View Raw File
Subscribe
Mute Notifications
Flag For Later
Award Token
Project Tags
None
Referenced Files
F104316431: ceph-csi-cephfs
Tue, Sep 22, 12:48 PM
2026-09-22 12:48:34 (UTC+0)
Subscribers
None
Comparing release=ceph-csi-cephfs, chart=/home/atsuko/src/operations/deployment-charts/charts/ceph-csi-cephfs/, namespace=kube-system
kube-system, ceph-cephfs-hdd, StorageClass (storage.k8s.io) has changed:
...
kind: StorageClass
metadata:
name: ceph-cephfs-hdd
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
release: ceph-csi-cephfs
heritage: Helm
provisioner: cephfs.csi.ceph.com
parameters:
clusterID: 8e69717a-518b-4c00-9f96-0635d9b913c6
...
kube-system, ceph-cephfs-ssd, StorageClass (storage.k8s.io) has changed:
...
kind: StorageClass
metadata:
name: ceph-cephfs-ssd
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
release: ceph-csi-cephfs
heritage: Helm
provisioner: cephfs.csi.ceph.com
parameters:
clusterID: 8e69717a-518b-4c00-9f96-0635d9b913c6
...
kube-system, ceph-csi-cephfs-ceph-config, ConfigMap (v1) has changed:
...
metadata:
name: "ceph-csi-cephfs-ceph-config"
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: nodeplugin
release: ceph-csi-cephfs
heritage: Helm
data:
ceph.conf: |
[global]
auth_cluster_required = cephx
auth_service_required = cephx
auth_client_required = cephx
-
- # Workaround for http://tracker.ceph.com/issues/23446
- fuse_set_user_groups = false
# ceph-fuse which uses libfuse2 by default has write buffer size of 2KiB
# adding 'fuse_big_writes = true' option by default to override this limit
# see https://github.com/ceph/ceph-csi/issues/1928
fuse_big_writes = true
...
kube-system, ceph-csi-cephfs-config, ConfigMap (v1) has changed:
...
metadata:
name: "ceph-csi-cephfs-config"
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
data:
config.json: |-
...
kube-system, ceph-csi-cephfs-nodeplugin, DaemonSet (apps) has changed:
...
metadata:
name: ceph-csi-cephfs-nodeplugin
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: nodeplugin
release: ceph-csi-cephfs
heritage: Helm
spec:
selector:
...
type: RollingUpdate
template:
metadata:
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: nodeplugin
release: ceph-csi-cephfs
heritage: Helm
spec:
+ securityContext:
+ {}
serviceAccountName: ceph-csi-cephfs-nodeplugin
priorityClassName: system-node-critical
hostNetwork: true
hostPID: true
# to use e.g. Rook orchestrated cluster, and mons' FQDN is
# resolved through k8s service, set dns policy to cluster first
dnsPolicy: ClusterFirstWithHostNet
containers:
- - name: driver-registrar
- # This container requires write privileges to the hostPath
- # /var/lib/kubelet/plugins_registry in order to create a socket
- # that is used to register the plugin with the kubelet.
- securityContext:
- runAsUser: 0
- privileged: true
- allowPrivilegeEscalation: true
- image: "docker-registry.discovery.wmnet/repos/data-engineering/kubernetes/csi/csi-node-driver-registrar:2024-08-22-120807-77a5c01b194c89e260e0036d452576b4c6f7b376@sha256:2ec5cc7339112097310d44a46e7855f413321490ceae9609ac1e2bbaf63b8e8c"
- imagePullPolicy: IfNotPresent
- args:
- - "--v=5"
- - "--csi-address=/csi/csi.sock"
- - "--kubelet-registration-path=/var/lib/kubelet/plugins/cephfs.csi.ceph.com/csi.sock"
- env:
- - name: KUBE_NODE_NAME
- valueFrom:
- fieldRef:
- fieldPath: spec.nodeName
- volumeMounts:
- - name: socket-dir
- mountPath: /csi
- - name: registration-dir
- mountPath: /registration
- resources:
- {}
- name: csi-cephfsplugin
- image: "docker-registry.discovery.wmnet/repos/data-engineering/ceph-csi:2026-06-11-173435-f35c22fc39d70394e218d98db84c6a4ede877884@sha256:f0d4d0717f44475882e0b53093b114116938633d5d4e6a0c1a6a0820acb537e2"
+ image: "docker-registry.discovery.wmnet/repos/data-engineering/ceph-csi:2026-09-18-134456-904779674c9496bf744cb072864906505607d2bf@sha256:1cf0d13631f0c5dd9d4fda80bc5b67c2ae4956a99193f69136476a23bb678776"
imagePullPolicy: IfNotPresent
args:
- "--nodeid=$(NODE_ID)"
- "--type=cephfs"
- "--nodeserver=true"
...
- "--kernelmountoptions="
- "--fusemountoptions="
- "--endpoint=$(CSI_ENDPOINT)"
- "--v=5"
- "--drivername=$(DRIVER_NAME)"
+ - "--enable-read-affinity=false"
+ - "--logslowopinterval=30s"
env:
- name: POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
...
mountPath: /etc/ceph-csi-config/
- name: keys-tmp-dir
mountPath: /tmp/csi/keys
- name: ceph-csi-mountinfo
mountPath: /csi/mountinfo
+ resources:
+ {}
+ - name: driver-registrar
+ # This container requires write privileges to the hostPath
+ # /var/lib/kubelet/plugins_registry in order to create a socket
+ # that is used to register the plugin with the kubelet.
+ securityContext:
+ runAsUser: 0
+ privileged: true
+ allowPrivilegeEscalation: true
+ image: "docker-registry.discovery.wmnet/repos/data-engineering/kubernetes/csi/csi-node-driver-registrar:2026-09-21-110728-306e18f10e1e7869bddcd8daca94d2927774f8e6@sha256:d0ad01310fd8e0d3ce8218db514a2bf9a1e4bb5697af0c8714f2749a7e8fbc89"
+ imagePullPolicy: IfNotPresent
+ args:
+ - "--v=5"
+ - "--csi-address=/csi/csi.sock"
+ - "--kubelet-registration-path=/var/lib/kubelet/plugins/cephfs.csi.ceph.com/csi.sock"
+ env:
+ - name: KUBE_NODE_NAME
+ valueFrom:
+ fieldRef:
+ fieldPath: spec.nodeName
+ volumeMounts:
+ - name: socket-dir
+ mountPath: /csi
+ - name: registration-dir
+ mountPath: /registration
resources:
{}
volumes:
- name: socket-dir
hostPath:
...
kube-system, ceph-csi-cephfs-nodeplugin, ServiceAccount (v1) has changed:
...
metadata:
name: ceph-csi-cephfs-nodeplugin
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: nodeplugin
release: ceph-csi-cephfs
heritage: Helm
kube-system, ceph-csi-cephfs-nodeplugin-http-metrics, Service (v1) has changed:
...
metadata:
name: ceph-csi-cephfs-nodeplugin-http-metrics
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: nodeplugin
release: ceph-csi-cephfs
heritage: Helm
spec:
ports:
...
kube-system, ceph-csi-cephfs-provisioner, ClusterRole (rbac.authorization.k8s.io) has changed:
...
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ceph-csi-cephfs-provisioner
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
rules:
+ # WMF: upstream also grants secrets, configmaps, events and the snapshot
+ # status subresources cluster wide. We grant those in each tenant namespace
+ # instead. See provisioner-role.yaml. Only the cluster scoped resources stay
+ # here, because a namespaced Role cannot grant them.
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list","watch"]
kube-system, ceph-csi-cephfs-provisioner, ClusterRoleBinding (rbac.authorization.k8s.io) has changed:
...
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ceph-csi-cephfs-provisioner
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
subjects:
- kind: ServiceAccount
...
kube-system, ceph-csi-cephfs-provisioner, Deployment (apps) has changed:
...
metadata:
name: ceph-csi-cephfs-provisioner
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
spec:
replicas: 3
...
release: ceph-csi-cephfs
template:
metadata:
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
spec:
affinity:
...
- key: component
operator: In
values:
- provisioner
topologyKey: "kubernetes.io/hostname"
+ securityContext:
+ {}
serviceAccountName: ceph-csi-cephfs-provisioner
hostNetwork: false
priorityClassName: system-cluster-critical
containers:
- - name: csi-provisioner
- image: "docker-registry.discovery.wmnet/repos/data-engineering/kubernetes/csi/csi-provisioner:2024-08-22-120807-77a5c01b194c89e260e0036d452576b4c6f7b376@sha256:2e3be4184503ba6b70ad26d4ef9f6d22624f72cbb9c57e5e778a2fb20356949d"
- imagePullPolicy: IfNotPresent
- args:
- - "--csi-address=$(ADDRESS)"
- - "--v=1"
- - "--timeout=60s"
- - "--leader-election=true"
- - "--retry-interval-start=500ms"
- - "--extra-create-metadata=true"
- - "--feature-gates=HonorPVReclaimPolicy=true"
- - "--prevent-volume-mode-conversion=true"
- env:
- - name: ADDRESS
- value: "unix:///csi/csi-provisioner.sock"
- volumeMounts:
- - name: socket-dir
- mountPath: /csi
- resources:
- {}
- - name: csi-resizer
- image: "docker-registry.discovery.wmnet/repos/data-engineering/kubernetes/csi/csi-resizer:2024-08-22-120807-77a5c01b194c89e260e0036d452576b4c6f7b376@sha256:255f17ae27ff06eae246d1ac8535e278069f1f3dabd8d315f5254470bd3fc164"
- imagePullPolicy: IfNotPresent
- args:
- - "--v=1"
- - "--csi-address=$(ADDRESS)"
- - "--timeout=60s"
- - "--leader-election"
- - "--retry-interval-start=500ms"
- - "--handle-volume-inuse-error=false"
- - "--feature-gates=RecoverVolumeExpansionFailure=true"
- env:
- - name: ADDRESS
- value: "unix:///csi/csi-provisioner.sock"
- volumeMounts:
- - name: socket-dir
- mountPath: /csi
- resources:
- {}
- name: csi-cephfsplugin
- image: "docker-registry.discovery.wmnet/repos/data-engineering/ceph-csi:2026-06-11-173435-f35c22fc39d70394e218d98db84c6a4ede877884@sha256:f0d4d0717f44475882e0b53093b114116938633d5d4e6a0c1a6a0820acb537e2"
+ image: "docker-registry.discovery.wmnet/repos/data-engineering/ceph-csi:2026-09-18-134456-904779674c9496bf744cb072864906505607d2bf@sha256:1cf0d13631f0c5dd9d4fda80bc5b67c2ae4956a99193f69136476a23bb678776"
imagePullPolicy: IfNotPresent
args:
- "--nodeid=$(NODE_ID)"
- "--type=cephfs"
- "--controllerserver=true"
- "--pidlimit=-1"
- "--endpoint=$(CSI_ENDPOINT)"
- "--v=5"
- "--drivername=$(DRIVER_NAME)"
- "--setmetadata=true"
+ - "--logslowopinterval=30s"
env:
- name: POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
...
mountPath: /etc/ceph/
- name: ceph-csi-config
mountPath: /etc/ceph-csi-config/
- name: keys-tmp-dir
mountPath: /tmp/csi/keys
+ resources:
+ {}
+ - name: csi-provisioner
+ image: "docker-registry.discovery.wmnet/repos/data-engineering/kubernetes/csi/csi-provisioner:2026-09-21-110728-306e18f10e1e7869bddcd8daca94d2927774f8e6@sha256:5b4b3b52b0663963879089e3c1ec86e5f0947f06c8ec12c326b0b49b75d48626"
+ imagePullPolicy: IfNotPresent
+ args:
+ - "--csi-address=$(ADDRESS)"
+ - "--v=1"
+ - "--timeout=60s"
+ - "--leader-election=true"
+ - "--retry-interval-start=500ms"
+ - "--extra-create-metadata=true"
+ - "--feature-gates=HonorPVReclaimPolicy=true"
+ - "--prevent-volume-mode-conversion=true"
+ env:
+ - name: ADDRESS
+ value: "unix:///csi/csi-provisioner.sock"
+ volumeMounts:
+ - name: socket-dir
+ mountPath: /csi
+ resources:
+ {}
+ - name: csi-resizer
+ image: "docker-registry.discovery.wmnet/repos/data-engineering/kubernetes/csi/csi-resizer:2026-09-21-110728-306e18f10e1e7869bddcd8daca94d2927774f8e6@sha256:34bede5dc15e585f33a1ad9ecbd57b8fc8289b168d27900149ebe4cd916e6e20"
+ imagePullPolicy: IfNotPresent
+ args:
+ - "--v=1"
+ - "--csi-address=$(ADDRESS)"
+ - "--timeout=60s"
+ - "--leader-election"
+ - "--retry-interval-start=500ms"
+ - "--handle-volume-inuse-error=false"
+ - "--feature-gates=RecoverVolumeExpansionFailure=true"
+ env:
+ - name: ADDRESS
+ value: "unix:///csi/csi-provisioner.sock"
+ volumeMounts:
+ - name: socket-dir
+ mountPath: /csi
resources:
{}
- name: liveness-prometheus
- image: "docker-registry.discovery.wmnet/repos/data-engineering/ceph-csi:2026-06-11-173435-f35c22fc39d70394e218d98db84c6a4ede877884@sha256:f0d4d0717f44475882e0b53093b114116938633d5d4e6a0c1a6a0820acb537e2"
+ image: "docker-registry.discovery.wmnet/repos/data-engineering/ceph-csi:2026-09-18-134456-904779674c9496bf744cb072864906505607d2bf@sha256:1cf0d13631f0c5dd9d4fda80bc5b67c2ae4956a99193f69136476a23bb678776"
imagePullPolicy: IfNotPresent
args:
- "--type=liveness"
- "--endpoint=$(CSI_ENDPOINT)"
- "--metricsport=8081"
...
kube-system, ceph-csi-cephfs-provisioner, Role (rbac.authorization.k8s.io) has changed:
...
metadata:
name: ceph-csi-cephfs-provisioner
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
rules:
- apiGroups: [""]
...
kube-system, ceph-csi-cephfs-provisioner, RoleBinding (rbac.authorization.k8s.io) has changed:
...
metadata:
name: ceph-csi-cephfs-provisioner
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
subjects:
- kind: ServiceAccount
...
kube-system, ceph-csi-cephfs-provisioner, ServiceAccount (v1) has changed:
...
metadata:
name: ceph-csi-cephfs-provisioner
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
kube-system, ceph-csi-cephfs-provisioner-http-metrics, Service (v1) has changed:
...
metadata:
name: ceph-csi-cephfs-provisioner-http-metrics
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
spec:
ports:
...
kube-system, ceph-csi-cephfs-provisioner-tenant, Role (rbac.authorization.k8s.io) has changed:
...
metadata:
name: ceph-csi-cephfs-provisioner-tenant
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
rules:
- apiGroups: [""]
...
kube-system, ceph-csi-cephfs-provisioner-tenant, RoleBinding (rbac.authorization.k8s.io) has changed:
...
metadata:
name: ceph-csi-cephfs-provisioner-tenant
namespace: kube-system
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
component: provisioner
release: ceph-csi-cephfs
heritage: Helm
subjects:
- kind: ServiceAccount
...
kube-system, cephfs.csi.ceph.com, CSIDriver (storage.k8s.io) has changed:
# Source: ceph-csi-cephfs/templates/csidriver-crd.yaml
apiVersion: storage.k8s.io/v1
-
kind: CSIDriver
metadata:
name: cephfs.csi.ceph.com
+ labels:
+ app: ceph-csi-cephfs
+ chart: ceph-csi-cephfs-0.2.0
+ release: ceph-csi-cephfs
+ heritage: Helm
spec:
attachRequired: false
podInfoOnMount: false
fsGroupPolicy: File
+ seLinuxMount: true
kube-system, csi-cephfs-secret, Secret (v1) has changed:
...
apiVersion: v1
kind: Secret
metadata:
labels:
app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
+ chart: ceph-csi-cephfs-0.2.0
heritage: Helm
release: ceph-csi-cephfs
name: csi-cephfs-secret
namespace: kube-system
data:
- adminID: '-------- # (18 bytes)'
- adminKey: '-------- # (40 bytes)'
+ userID: '++++++++ # (18 bytes)'
+ userKey: '++++++++ # (49 bytes)'
analytics, ceph-csi-cephfs-provisioner-tenant, Role (rbac.authorization.k8s.io) has been removed:
- # Source: ceph-csi-cephfs/templates/provisioner-role.yaml
- kind: Role
- apiVersion: rbac.authorization.k8s.io/v1
- metadata:
- name: ceph-csi-cephfs-provisioner-tenant
- namespace: analytics
- labels:
- app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
- component: provisioner
- release: ceph-csi-cephfs
- heritage: Helm
- rules:
- - apiGroups: [""]
- resources: ["secrets"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+
analytics, ceph-csi-cephfs-provisioner-tenant, RoleBinding (rbac.authorization.k8s.io) has been removed:
- # Source: ceph-csi-cephfs/templates/provisioner-rolebinding.yaml
- kind: RoleBinding
- apiVersion: rbac.authorization.k8s.io/v1
- metadata:
- name: ceph-csi-cephfs-provisioner-tenant
- namespace: analytics
- labels:
- app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
- component: provisioner
- release: ceph-csi-cephfs
- heritage: Helm
- subjects:
- - kind: ServiceAccount
- name: ceph-csi-cephfs-provisioner
- namespace: kube-system
- roleRef:
- kind: Role
- name: ceph-csi-cephfs-provisioner-tenant
- apiGroup: rbac.authorization.k8s.io
+
analytics-test, ceph-csi-cephfs-provisioner-tenant, Role (rbac.authorization.k8s.io) has been removed:
- # Source: ceph-csi-cephfs/templates/provisioner-role.yaml
- kind: Role
- apiVersion: rbac.authorization.k8s.io/v1
- metadata:
- name: ceph-csi-cephfs-provisioner-tenant
- namespace: analytics-test
- labels:
- app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
- component: provisioner
- release: ceph-csi-cephfs
- heritage: Helm
- rules:
- - apiGroups: [""]
- resources: ["secrets"]
- verbs: ["get", "list"]
- - apiGroups: [""]
- resources: ["events"]
- verbs: ["list", "watch", "create", "update", "patch"]
- - apiGroups: [""]
- resources: ["persistentvolumeclaims/status"]
- verbs: ["update", "patch"]
+
analytics-test, ceph-csi-cephfs-provisioner-tenant, RoleBinding (rbac.authorization.k8s.io) has been removed:
- # Source: ceph-csi-cephfs/templates/provisioner-rolebinding.yaml
- kind: RoleBinding
- apiVersion: rbac.authorization.k8s.io/v1
- metadata:
- name: ceph-csi-cephfs-provisioner-tenant
- namespace: analytics-test
- labels:
- app: ceph-csi-cephfs
- chart: ceph-csi-cephfs-0.1.8
- component: provisioner
- release: ceph-csi-cephfs
- heritage: Helm
- subjects:
- - kind: ServiceAccount
- name: ceph-csi-cephfs-provisioner
- namespace: kube-system
- roleRef:
- kind: Role
- name: ceph-csi-cephfs-provisioner-tenant
- apiGroup: rbac.authorization.k8s.io
+
kube-system, ceph-csi-cephfs-nodeplugin, ClusterRole (rbac.authorization.k8s.io) has been added:
-
+ # Source: ceph-csi-cephfs/templates/nodeplugin-clusterrole.yaml
+ kind: ClusterRole
+ apiVersion: rbac.authorization.k8s.io/v1
+ metadata:
+ name: ceph-csi-cephfs-nodeplugin
+ labels:
+ app: ceph-csi-cephfs
+ chart: ceph-csi-cephfs-0.2.0
+ component: nodeplugin
+ release: ceph-csi-cephfs
+ heritage: Helm
+ rules:
+ # nodes is cluster scoped, so a namespaced Role cannot grant it.
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get"]
+ # WMF: upstream also grants "get" on configmaps here, to read the Vault token
+ # and connection options from a tenant namespace. We do not use the Vault
+ # KMS, so that grant is left out.
kube-system, ceph-csi-cephfs-nodeplugin, ClusterRoleBinding (rbac.authorization.k8s.io) has been added:
-
+ # Source: ceph-csi-cephfs/templates/nodeplugin-clusterrolebinding.yaml
+ kind: ClusterRoleBinding
+ apiVersion: rbac.authorization.k8s.io/v1
+ metadata:
+ name: ceph-csi-cephfs-nodeplugin
+ labels:
+ app: ceph-csi-cephfs
+ chart: ceph-csi-cephfs-0.2.0
+ component: nodeplugin
+ release: ceph-csi-cephfs
+ heritage: Helm
+ subjects:
+ - kind: ServiceAccount
+ name: ceph-csi-cephfs-nodeplugin
+ namespace: kube-system
+ roleRef:
+ kind: ClusterRole
+ name: ceph-csi-cephfs-nodeplugin
+ apiGroup: rbac.authorization.k8s.io
kube-system, ceph-csi-encryption-kms-config, ConfigMap (v1) has been added:
-
+ # Source: ceph-csi-cephfs/templates/encryptionkms-configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+ name: "ceph-csi-encryption-kms-config"
+ namespace: kube-system
+ labels:
+ app: ceph-csi-cephfs
+ chart: ceph-csi-cephfs-0.2.0
+ component: nodeplugin
+ release: ceph-csi-cephfs
+ heritage: Helm
+ data:
+ config.json: |-
+ {}
Event Timeline
atsuko
created this paste.
Tue, Sep 22, 12:48 PM
2026-09-22 12:48:34 (UTC+0)
Log In to Comment