diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 8078552c..379346e9 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -4,36 +4,6 @@ kind: ClusterRole metadata: name: manager-role rules: -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - pods/log - verbs: - - get -- apiGroups: - - batch - resources: - - jobs - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - apiGroups: - lightspeed.openstack.org resources: @@ -99,14 +69,37 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: manager-role - namespace: openstack-lightspeed + namespace: openshift-lightspeed rules: +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - pods/log + verbs: + - get +- apiGroups: + - batch + resources: + - jobs + verbs: + - create + - delete + - get + - list + - watch - apiGroups: - operators.coreos.com resources: - clusterserviceversions verbs: - - create - delete - patch - update @@ -114,6 +107,15 @@ rules: - operators.coreos.com resources: - installplans + verbs: + - delete + - get + - list + - update + - watch +- apiGroups: + - operators.coreos.com + resources: - subscriptions verbs: - create diff --git a/internal/controller/openstacklightspeed_controller.go b/internal/controller/openstacklightspeed_controller.go index 15427a93..18d3cb3b 100644 --- a/internal/controller/openstacklightspeed_controller.go +++ b/internal/controller/openstacklightspeed_controller.go @@ -60,12 +60,12 @@ func (r *OpenStackLightspeedReconciler) GetLogger(ctx context.Context) logr.Logg // +kubebuilder:rbac:groups=ols.openshift.io,resources=olsconfigs/status,verbs=get;update;patch // +kubebuilder:rbac:groups=ols.openshift.io,resources=olsconfigs/finalizers,verbs=update // +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,verbs=get;list;watch -// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=create;update;patch;delete -// +kubebuilder:rbac:groups=operators.coreos.com,resources=subscriptions,namespace=openstack-lightspeed,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups=operators.coreos.com,resources=installplans,namespace=openstack-lightspeed,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch -// +kubebuilder:rbac:groups="",resources=pods/log,verbs=get +// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openshift-lightspeed,verbs=update;patch;delete +// +kubebuilder:rbac:groups=operators.coreos.com,resources=subscriptions,namespace=openshift-lightspeed,verbs=get;list;watch;create;update;patch;delete +// +kubebuilder:rbac:groups=operators.coreos.com,resources=installplans,namespace=openshift-lightspeed,verbs=get;list;watch;update;delete +// +kubebuilder:rbac:groups=batch,resources=jobs,namespace=openshift-lightspeed,verbs=get;list;watch;create;delete +// +kubebuilder:rbac:groups="",resources=pods,namespace=openshift-lightspeed,verbs=get;list;watch +// +kubebuilder:rbac:groups="",resources=pods/log,namespace=openshift-lightspeed,verbs=get // Reconcile is part of the main kubernetes reconciliation loop which aims to // move the current state of the cluster closer to the desired state.