DevContainer User
59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
# ADR 004: Read-Only Plugin with Cluster-Wide RBAC Scope
|
|
|
|
**Status**: Accepted
|
|
|
|
**Date**: 2026-03-05
|
|
|
|
**Deciders**: Development Team
|
|
|
|
---
|
|
|
|
## Context
|
|
|
|
Rook-Ceph manages cluster-wide storage infrastructure. The plugin needs to display:
|
|
|
|
- **Ceph CRDs**: CephClusters, CephBlockPools, CephFilesystems, CephObjectStores (all cluster-scoped or in the `rook-ceph` namespace)
|
|
- **Cluster-scoped K8s resources**: StorageClasses, PersistentVolumes
|
|
- **Namespace-spanning resources**: PersistentVolumeClaims (all namespaces)
|
|
|
|
The plugin could offer write operations (create/delete storage classes, manage pools) or remain strictly read-only. RBAC must cover all namespaces for PVCs to show complete storage utilization.
|
|
|
|
---
|
|
|
|
## Decision
|
|
|
|
The plugin is strictly read-only — no create, update, delete, or patch operations.
|
|
|
|
- RBAC requires only `get` and `list` verbs across cluster scope.
|
|
- PVCs are fetched with `{namespace: ''}` (all namespaces).
|
|
- This minimizes the RBAC footprint while providing comprehensive visibility.
|
|
|
|
---
|
|
|
|
## Consequences
|
|
|
|
- ✅ Minimal RBAC requirements (read-only `get` and `list` only)
|
|
- ✅ No risk of accidental mutation of storage infrastructure
|
|
- ✅ Safe for monitoring and observability use cases
|
|
- ✅ Can be deployed in restrictive environments with minimal permissions
|
|
- ⚠️ Users cannot manage Rook resources from the UI
|
|
- ⚠️ Must use `kubectl` or the Rook toolbox for operational tasks
|
|
|
|
Mitigated by the plugin's purpose being observability, not management. Storage infrastructure changes are high-risk and better suited to GitOps or controlled `kubectl` workflows.
|
|
|
|
---
|
|
|
|
## Alternatives Considered
|
|
|
|
1. **Full CRUD operations** — Rejected. Storage infrastructure changes are high-risk and better suited to GitOps/kubectl workflows with proper review processes.
|
|
|
|
2. **Read-only with namespace-scoped PVC filtering** — Rejected. Would miss cross-namespace storage utilization data, providing an incomplete picture of cluster storage usage.
|
|
|
|
3. **Optional write mode via RBAC detection** — Rejected. Adds significant complexity (capability detection, conditional UI) for unclear benefit given the observability focus.
|
|
|
|
---
|
|
|
|
## Changelog
|
|
|
|
- 2026-03-05: Initial decision accepted
|