Merge pull request #749 from NVIDIA/cc-mgr-vgpu-dm-rbac

[CC Mgr VGPU Device Mgr] move pods access permissions from ClusterRole to Role

Author: tariq1890

assets/state-cc-manager/0200_role.yaml

@@ -12,3 +12,11 @@ rules:
   - use
   resourceNames:
   - privileged
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch

assets/state-cc-manager/0210_clusterrole.yaml

@@ -7,7 +7,6 @@ rules:
   - ""
   resources:
   - nodes
-  - pods
   verbs:
   - get
   - list

assets/state-vgpu-device-manager/0200_role.yaml

@@ -0,0 +1,22 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: nvidia-vgpu-device-manager
+  namespace: "FILLED BY THE OPERATOR"
+rules:
+- apiGroups:
+  - security.openshift.io
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+  resourceNames:
+  - privileged
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch

assets/state-vgpu-device-manager/0210_clusterrole.yaml

@@ -14,8 +14,6 @@ rules:
   - ""
   resources:
   - nodes
-  - pods
-  - pods/eviction
   verbs:
   - get
   - list

assets/state-vgpu-device-manager/0300_rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: nvidia-vgpu-device-manager
+  namespace: "FILLED BY THE OPERATOR"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: nvidia-vgpu-device-manager
+subjects:
+- kind: ServiceAccount
+  name: nvidia-vgpu-device-manager
+  namespace: "FILLED BY THE OPERATOR"