From 690f80179afdf29f0abd946a15700a0176f5686f Mon Sep 17 00:00:00 2001 From: Carl Braganza Date: Mon, 3 Jul 2023 11:17:24 -0700 Subject: [PATCH] Propose a new role for session data. --- .../3314-csi-changed-block-tracking/README.md | 4 ++ .../roles.drawio.svg | 44 ++++++++++++++++++- 2 files changed, 47 insertions(+), 1 deletion(-) diff --git a/keps/sig-storage/3314-csi-changed-block-tracking/README.md b/keps/sig-storage/3314-csi-changed-block-tracking/README.md index ec9d4eb7c34..2bc3dac2039 100644 --- a/keps/sig-storage/3314-csi-changed-block-tracking/README.md +++ b/keps/sig-storage/3314-csi-changed-block-tracking/README.md @@ -341,6 +341,7 @@ individual driver Namespace. The creation and use of a snapshot session is illustrated in the figure below, with additional information available in the [Design Details](#design-details) section. +> @TODO Eventually use a PNG - SVG does not render text spaces properly. ![Snapshot Session](./session.drawio.svg) @@ -492,7 +493,10 @@ to implement the necessary RBAC policy as illustrated in the following figure: > in a RoleBinding and in a ClusterRoleBinding? > I think the ClusterRoleBinding would result in the SA getting access to > SnapshotSessionData in other CSI driver namespaces. +> I propose a **SnapshotSessionData** ClusterRole that the sidecar's SA can +> use with a RoleBinding to get access to the SnapshotSessionData CR. +> @TODO Eventually use a PNGs - SVG does not render text spaces properly. ![CSI Snapshot Session Roles](./roles.drawio.svg) - The **SnapshotSessionClient** ClusterRole should be used in a diff --git a/keps/sig-storage/3314-csi-changed-block-tracking/roles.drawio.svg b/keps/sig-storage/3314-csi-changed-block-tracking/roles.drawio.svg index 59d9abc228b..215478c3a9a 100644 --- a/keps/sig-storage/3314-csi-changed-block-tracking/roles.drawio.svg +++ b/keps/sig-storage/3314-csi-changed-block-tracking/roles.drawio.svg @@ -1,4 +1,4 @@ - +