Merge pull request #14415 from pospispa/bugzilla1457092-Dynamic-provi…

…sioning-failed-when-zone-is-not-specified-in-the-StorageClass-incorrect-scc-permissions-for-pv-controller Merged by openshift-bot
openshift · Jun 3, 2017 · 90592c5 · 90592c5
2 parents 663ad03 + 54b994c
commit 90592c5
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/pkg/cmd/server/bootstrappolicy/infra_sa_policy.go b/pkg/cmd/server/bootstrappolicy/infra_sa_policy.go
@@ -373,6 +373,13 @@ func init() {
 					Verbs:     sets.NewString("get"),
 					Resources: sets.NewString("secrets"),
 				},
+				// Cinder provisioner needs to get list of nodes in order
+				// to get list of available zones in the cluster in order to choose a zone
+				// in case it's not configured in corresponding Storage Class
+				{
+					Verbs:     sets.NewString("list", "watch"),
+					Resources: sets.NewString("nodes"),
+				},
 			},
 		},
 	)

diff --git a/test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml b/test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml
@@ -3161,6 +3161,14 @@ items:
     - secrets
     verbs:
     - get
+  - apiGroups:
+    - ""
+    attributeRestrictions: null
+    resources:
+    - nodes
+    verbs:
+    - list
+    - watch
 - apiVersion: v1
   kind: ClusterRole
   metadata: