deploy: add RBAC for cephfs provisioner to access volumeattributesclass

The CephFS provisioner needs to read VolumeAttributesClass objects to
support MDS pinning via ControllerModifyVolume. Without this the e2e
test fails with "cannot get resource volumeattributesclasses in API
group storage.k8s.io at the cluster scope".

Add the required RBAC rule to both the static deployment manifest and
the CephFS Helm chart, matching what RBD already has.

Assisted-by: goose <noreply@block.xyz>
Signed-off-by: Ismael Puerto Freire <ismaelpf@inditex.com>

Author: ismaelpuerto

charts/ceph-csi-cephfs/templates/provisioner-clusterrole.yaml

@@ -41,6 +41,9 @@ rules:
   - apiGroups: [""]
     resources: ["nodes"]
     verbs: ["get", "list","watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattributesclasses"]
+    verbs: ["get", "list", "watch"]
 {{- if .Values.provisioner.snapshotter.args.enableVolumeGroupSnapshots }}
   - apiGroups: ["snapshot.storage.k8s.io"]
     resources: ["volumesnapshots"]

deploy/cephfs/kubernetes/csi-provisioner-rbac.yaml

@@ -80,6 +80,9 @@ rules:
   - apiGroups: ["replication.storage.openshift.io"]
     resources: ["volumegroupreplicationclasses"]
     verbs: ["get"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattributesclasses"]
+    verbs: ["get", "list", "watch"]
 
 ---
 kind: ClusterRoleBinding