11.6. Enabling user permissions to clone data volumes across namespaces

Procedure

1. Create a ClusterRole manifest:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: <datavolume_cloner>
   rules:
   - apiGroups: ["cdi.kubevirt.io"]
     resources: ["datavolumes/source"]
     verbs: ["*"]
   # ...

   where:

   <datavolume_cloner>

   Specifies a unique name for the cluster role.

2. Create the cluster role in the cluster:

   $ oc create -f <datavolume_cloner.yaml>

   where:

   <datavolume_cloner.yaml>

   Specifies the file name of the ClusterRole manifest created in the previous step.

3. Create a RoleBinding manifest that applies to both the source and destination namespaces and references the cluster role created in the previous step.

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: <allow_clone_to_user>
     namespace: <source_namespace>
   subjects:
   - kind: ServiceAccount
     name: default
     namespace: <destination_namespace>
   roleRef:
     kind: ClusterRole
     name: datavolume-cloner
     apiGroup: rbac.authorization.k8s.io

   • metadata.name specifies a unique name for the role binding.
   • metadata.namespace specifies the namespace for the source data volume.
   • subjects.namespace specifies the namespace to which the data volume is cloned.
   • roleRef.name specifies the name of the cluster role created in the previous step.

4. Create the role binding in the cluster:

   $ oc create -f <datavolume_cloner.yaml>

   where:

   <datavolume_cloner.yaml>

   Specifies the file name of the RoleBinding manifest created in the previous step.