diff --git a/cluster/kube/lib/rook.libsonnet b/cluster/kube/lib/rook.libsonnet
index 8f83d2d..4edfe7d 100644
--- a/cluster/kube/lib/rook.libsonnet
+++ b/cluster/kube/lib/rook.libsonnet
@@ -10,7 +10,7 @@
         local env = self,
         local cfg = env.cfg,
         cfg:: {
-            image: "rook/ceph:v1.1.9",
+            image: "rook/ceph:v1.2.7",
             namespace: "rook-ceph-system",
         },
 
@@ -236,6 +236,15 @@
                     subresources: { status: {} },
                 },
             },
+            cephclients: kube.CustomResourceDefinition("ceph.rook.io", "v1", "CephClient") {
+                spec+: {
+                    validation: oa.Validation(oa.Dict {
+                        spec: oa.Dict {
+                            caps: oa.Any,
+                        },
+                    }),
+                },
+            },
         },
 
         sa: {
@@ -307,9 +316,24 @@
                     },
                     {
                         apiGroups: ["policy", "apps"],
-                        resources: ["poddisruptionbudgets", "deployments"],
+                        resources: ["poddisruptionbudgets", "deployments", "replicasets"],
                         verbs: ["*"],
                     },
+                    {
+                        apiGroups: ["healthchecking.openshift.io"],
+                        resources: ["machinedisruptionbudgets"],
+                        verbs: ["get", "list", "watch", "create", "update", "delete"],
+                    },
+                    {
+                        apiGroups: ["machine.openshift.io"],
+                        resources: ["machines"],
+                        verbs: ["get", "list", "watch", "create", "update", "delete"],
+                    },
+                    {
+                        apiGroups: ["storage.k8s.io"],
+                        resources: ["csidrivers"],
+                        verbs: ["create"],
+                    },
                 ],
             },
 
@@ -733,7 +757,17 @@
                         apiGroups: [""],
                         resources: ["configmaps"],
                         verbs: ["get", "list", "watch", "create", "update", "delete"],
-                    }
+                    },
+                ],
+            },
+            osdCluster: kube.ClusterRole(cluster.name("osd-cluster")) {
+                metadata+: cluster.metadata { namespace:: null },
+                rules: [
+                    {
+                        apiGroups: [""],
+                        resources: ["nodes"],
+                        verbs: ["get", "list"],
+                    },
                 ],
             },
             mgr: kube.Role(cluster.name("mgr")) {
@@ -802,6 +836,15 @@
             subjects_: [cluster.sa.mgr],
         },
 
+        osdClusterRB: kube.ClusterRoleBinding(cluster.name("osd-cluster")) {
+            metadata+: {
+                namespace:: null,
+            },
+            roleRef_: cluster.roles.osdCluster,
+            subjects_: [cluster.sa.osd],
+        },
+
+
         cluster: kube._Object("ceph.rook.io/v1", "CephCluster", name) {
             metadata+: cluster.metadata,
             spec: {