OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Enabling user permissions to clone DataVolumes across namespaces

The isolating nature of namespaces means that users cannot by default clone resources between namespaces.

To enable a user to clone a virtual machine to another namespace, a user with the cluster-admin role must create a new ClusterRole. Bind this ClusterRole to a user to enable them to clone virtual machines to the destination namespace.

Prerequisites

  • Only a user with the cluster-admin role can create ClusterRoles.

About DataVolumes

DataVolume objects are custom resources that are provided by the Containerized Data Importer (CDI) project. DataVolumes orchestrate import, clone, and upload operations that are associated with an underlying PersistentVolumeClaim (PVC). DataVolumes are integrated with KubeVirt, and they prevent a virtual machine from being started before the PVC has been prepared.

Creating RBAC resources for cloning DataVolumes

Create a new ClusterRole that enables permissions for all actions for the datavolumes resource.

Procedure

  1. Create a ClusterRole manifest:

    apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: <datavolume-cloner> (1)
rules:
- apiGroups: ["cdi.kubevirt.io"]
  resources: ["datavolumes/source"]
  verbs: ["*"]
    1 Unique name for the ClusterRole.

  2. Create the ClusterRole in the cluster:

    $ oc create -f <datavolume-cloner.yaml> (1)
    1 The file name of the ClusterRole manifest created in the previous step.

  3. Create a RoleBinding manifest that applies to both the source and destination namespaces and references the ClusterRole created in the previous step.

    apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: <allow-clone-to-user> (1)
  namespace: <Source namespace> (2)
subjects:
- kind: ServiceAccount
  name: default
  namespace: <Destination namespace> (3)
roleRef:
  kind: ClusterRole
  name: datavolume-cloner (4)
  apiGroup: rbac.authorization.k8s.io
    1 Unique name for the RoleBinding.
    2 The namespace for the source DataVolume.
    3 The namespace to which the DataVolume is cloned.
    4 The name of the ClusterRole created in the previous step.

  4. Create the RoleBinding in the cluster:

    $ oc create -f <datavolume-cloner.yaml> (1)
    1 The file name of the RoleBinding manifest created in the previous step.