update RBAC file

[pohly]

The RBAC file was copied unmodified from driver-registrar and probably is out-dated now.

The introduction still refers to "external provisioner" (was already broken when creating that file initially for driver-registrar).

[msau42]

I opened #8 to remove the old driver registration mechanism.

Then I think we can remove the whole rbac file.

I also scanned through the code and couldn't find anything using k8s events

[pohly]

@msau42 @jarrpa: 6d58825 removed the rbac.yaml. Was that intentionally or by mistake?

Neither the commit message nor the PR description mention the removal of the rbac.yaml, and people who want to know what RBAC rules are needed no longer find that information in this repo. For the sake of consistency there should be a deploy directory with a README.md saying that the lack of a rbac.yaml file is intentional.

[msau42]

Node driver registrar doesn't interact with the k8s API anymore so no rbac rules are needed.

We can update the README in this repo to be more descriptive about what node driver registrar does

[jarrpa]

While the README could use a touch-up, I think the removal of the RBAC file is only confusing if you knew the file was there to begin with. If we just say "it's a sidecar container" there should be no reason to assume it requires any API privileges unless stated otherwise. At best, a deploy/ directory would contain a sample DaemonSet for something like the hostPath driver that uses this sidecar, right?

[pohly]

"Jose A. Rivera" <[email protected]> writes:

While the README could use a touch-up, I think the removal of the RBAC file is only confusing if you knew the file was there to begin with.

Every other CSI sidecar container has one, so I think it will be normal that people will also expect it for node-driver-registrar.

[msau42]

I think it's sufficient if we document the readme for all the sidecars with the functionality.

For this repo, we can say that it plugs into the kubelet plugin registration mechanism by exposing a socket, etc.

For other repos, we can say, it watches and operates on these kubernetes objects.

[msau42]

And each readme can have a permissions section that describes what kind of rbacs and other roles it may need

[msau42]

Updating docs here: #13

[msau42]

README has been updated. Please update as you see fit.
/close

[k8s-ci-robot]

@msau42: Closing this issue.

In response to this:

README has been updated. Please update as you see fit.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.