Description of problem:

In BUILD-965, we reduced the RBAC granted to the Shared Resource CSI Driver. The documented process for cluster admins, however, leads to the same fundamental security problem of the CSI driver being granted excessive permissions.

Workaround: None

Prerequisites (if any, like setup, operators/versions):

Builds for OpenShift 1.1

Steps to Reproduce

Follow the procedure described in the Shared Resource CSI Driver README: https://github.com/openshift/csi-driver-shared-resource
 

Actual results:

Shared Resource CSI driver has permission to read any ConfigMap (bad). The equivalent procedure for Secrets would allow the CSI driver to read any Secret (really bad)

Expected results:

CSI driver should operate under principle of least privilege - its service account should only have permission to access specific Secrets or ConfigMaps.

Reproducibility (Always/Intermittent/Only Once):

Always

Acceptance criteria: 

• Documented procedure ensures cluster admins only grant minimal permissions to the Shared Resource CSI driver