add rbac rules to support deletion of snaps

Author: Pearl1594

cmd/cloudstack-csi-driver/Dockerfile

@@ -14,7 +14,9 @@ RUN apk add --no-cache \
     # blkid, mount and umount are required by k8s.io/mount-utils \
     blkid \
     mount \
-    umount
+    umount \
+    # Provides udevadm for device path detection \
+    udev
 
 COPY ./bin/cloudstack-csi-driver /cloudstack-csi-driver
-ENTRYPOINT ["/cloudstack-csi-driver"]
+ENTRYPOINT ["/cloudstack-csi-driver"]

deploy/k8s/rbac.yaml

@@ -86,3 +86,35 @@ roleRef:
   kind: ClusterRole
   name: cloudstack-csi-node-role
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cloudstack-csi-snapshotter-role
+rules:
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotcontents"]
+  verbs: ["create", "get", "list", "watch", "update", "delete"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshots"]
+  verbs: ["get", "list", "watch", "update"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshotcontents/status"]
+  verbs: ["update"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cloudstack-csi-snapshotter-binding
+subjects:
+- kind: ServiceAccount
+  name: cloudstack-csi-controller
+  namespace: kube-system
+roleRef:
+  kind: ClusterRole
+  name: cloudstack-csi-snapshotter-role
+  apiGroup: rbac.authorization.k8s.io

pkg/driver/controller.go

@@ -286,7 +286,7 @@ func determineSize(req *csi.CreateVolumeRequest) (int64, error) {
 
 func (cs *controllerServer) DeleteVolume(ctx context.Context, req *csi.DeleteVolumeRequest) (*csi.DeleteVolumeResponse, error) {
 	logger := klog.FromContext(ctx)
-	logger.V(6).Info("DeleteVolume: called", "args", *req)
+	logger.Info("DeleteVolume: called", "args", *req)
 
 	if req.GetVolumeId() == "" {
 		return nil, status.Error(codes.InvalidArgument, "Volume ID missing in request")