From 1ab98c2008846ecd9d95d8620615f68cb3170c41 Mon Sep 17 00:00:00 2001
From: John Reese <john@reese.dev>
Date: Fri, 6 Mar 2020 07:48:01 -0500
Subject: [PATCH] Add pods/portforward to role

---
 README.md             | 2 +-
 controller/sandbox.go | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 64fa5e8..d6a65d5 100644
--- a/README.md
+++ b/README.md
@@ -130,7 +130,7 @@ One `ClusterRoleBinding` per name in the `owners` field
 
 |Verbs|API Groups|Resources|
 |---|---|---|
-|*|core|pods, pods/log, services, services/finalizers, endpoints, persistentvolumeclaims, events, configmaps, replicationcontrollers|
+|*|core|pods, pods/log, pods/portforward, services, services/finalizers, endpoints, persistentvolumeclaims, events, configmaps, replicationcontrollers|
 |*|apps|deployments, daemonsets, replicasets, statefulsets|
 |*|autoscaling|horizontalpodautoscalers|
 |*|batch|jobs, cronjobs|
diff --git a/controller/sandbox.go b/controller/sandbox.go
index 1ff0a93..6d8fa25 100644
--- a/controller/sandbox.go
+++ b/controller/sandbox.go
@@ -204,6 +204,7 @@ func getRole(sandbox operatorsv1alpha1.Sandbox) rbacv1.Role {
 				Resources: []string{
 					"pods",
 					"pods/log",
+					"pods/portforward",
 					"services",
 					"services/finalizers",
 					"endpoints",