review feedback: tune rbd provisioner rbac

Signed-off-by: Huamin Chen <hchen@redhat.com>

deploy/cephfs/kubernetes/csi-attacher-rbac.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: csi-attacher
+  name: cephfs-csi-attacher
 
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: external-attacher-runner
+  name: cephfs-external-attacher-runner
 rules:
   - apiGroups: [""]
     resources: ["events"]
@@ -26,12 +26,12 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: csi-attacher-role
+  name: cephfs-csi-attacher-role
 subjects:
   - kind: ServiceAccount
-    name: csi-attacher
+    name: cephfs-csi-attacher
     namespace: default
 roleRef:
   kind: ClusterRole
-  name: external-attacher-runner
+  name: cephfs-external-attacher-runner
   apiGroup: rbac.authorization.k8s.io

deploy/cephfs/kubernetes/csi-cephfsplugin-attacher.yaml

@@ -24,7 +24,7 @@ spec:
       labels:
         app: csi-cephfsplugin-attacher
     spec:
-      serviceAccount: csi-attacher
+      serviceAccount: cephfs-csi-attacher
       containers:
         - name: csi-cephfsplugin-attacher
           image: quay.io/k8scsi/csi-attacher:v1.0.0

deploy/cephfs/kubernetes/csi-cephfsplugin-provisioner.yaml

@@ -24,7 +24,7 @@ spec:
       labels:
         app: csi-cephfsplugin-provisioner
     spec:
-      serviceAccount: csi-provisioner
+      serviceAccount: cephfs-csi-provisioner
       containers:
         - name: csi-provisioner
           image: quay.io/k8scsi/csi-provisioner:v1.0.0
@@ -44,7 +44,7 @@ spec:
             privileged: true
             capabilities:
               add: ["SYS_ADMIN"]
-          image: 127.0.0.1/root/cephfsplugin:v1.0.0
+          image: quay.io/cephcsi/cephfsplugin:v1.0.0
           args :
             - "--nodeid=$(NODE_ID)"
             - "--endpoint=$(CSI_ENDPOINT)"

deploy/cephfs/kubernetes/csi-cephfsplugin.yaml

@@ -11,7 +11,7 @@ spec:
       labels:
         app: csi-cephfsplugin
     spec:
-      serviceAccount: csi-nodeplugin
+      serviceAccount: cephfs-csi-nodeplugin
       hostNetwork: true
       # to use e.g. Rook orchestrated cluster, and mons' FQDN is
       # resolved through k8s service, set dns policy to cluster first

deploy/cephfs/kubernetes/csi-nodeplugin-rbac.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: csi-nodeplugin
+  name: cephfs-csi-nodeplugin
 
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: csi-nodeplugin
+  name: cephfs-csi-nodeplugin
 rules:
   - apiGroups: [""]
     resources: ["nodes"]
@@ -29,12 +29,12 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: csi-nodeplugin
+  name: cephfs-csi-nodeplugin
 subjects:
   - kind: ServiceAccount
-    name: csi-nodeplugin
+    name: cephfs-csi-nodeplugin
     namespace: default
 roleRef:
   kind: ClusterRole
-  name: csi-nodeplugin
+  name: cephfs-csi-nodeplugin
   apiGroup: rbac.authorization.k8s.io          

deploy/cephfs/kubernetes/csi-provisioner-rbac.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: csi-provisioner
+  name: cephfs-csi-provisioner
 
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: external-provisioner-runner
+  name: cephfs-external-provisioner-runner
 rules:
   - apiGroups: [""]
     resources: ["secrets"]
@@ -32,12 +32,12 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: csi-provisioner-role
+  name: cephfs-csi-provisioner-role
 subjects:
   - kind: ServiceAccount
-    name: csi-provisioner
+    name: cephfs-csi-provisioner
     namespace: default
 roleRef:
   kind: ClusterRole
-  name: external-provisioner-runner
+  name: cephfs-external-provisioner-runner
   apiGroup: rbac.authorization.k8s.io