chore: update operator manager permissions

topfreegames · Feb 6, 2024 · a02cc37 · a02cc37
1 parent 011c4b1
commit a02cc37
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 20 deletions.
diff --git a/.kubernetes/manifests.yaml b/.kubernetes/manifests.yaml
@@ -5503,27 +5503,31 @@ rules:
   resources:
   - clusters
   verbs:
-  - create
   - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - cluster.x-k8s.io
   resources:
-  - clusters/finalizers
+  - clusters/status
   verbs:
-  - update
+  - get
 - apiGroups:
   - cluster.x-k8s.io
   resources:
-  - clusters/status
+  - machinepools
+  verbs:
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - cluster.x-k8s.io
+  resources:
+  - machinepools/status
   verbs:
   - get
-  - patch
-  - update
 - apiGroups:
   - controlplane.cluster.x-k8s.io
   resources:
@@ -5730,7 +5734,7 @@ spec:
               optional: true
         - name: AWS_REGION
           value: us-east-1
-        image: tfgco/kubernetes-kops-operator:v0.9.0-alpha
+        image: tfgco/kubernetes-kops-operator:v0.10.0-alpha
         livenessProbe:
           httpGet:
             path: /healthz

diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -30,27 +30,31 @@ rules:
   resources:
   - clusters
   verbs:
-  - create
   - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - cluster.x-k8s.io
   resources:
-  - clusters/finalizers
+  - clusters/status
   verbs:
-  - update
+  - get
 - apiGroups:
   - cluster.x-k8s.io
   resources:
-  - clusters/status
+  - machinepools
+  verbs:
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - cluster.x-k8s.io
+  resources:
+  - machinepools/status
   verbs:
   - get
-  - patch
-  - update
 - apiGroups:
   - controlplane.cluster.x-k8s.io
   resources:

diff --git a/controllers/controlplane/kopscontrolplane_controller.go b/controllers/controlplane/kopscontrolplane_controller.go
@@ -507,9 +507,10 @@ func (r *KopsControlPlaneReconciliation) reconcileClusterAddons(ctx context.Cont
 //+kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=kopsmachinepools,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=kopsmachinepools/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=kopsmachinepools/finalizers,verbs=update
-//+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters/finalizers,verbs=update
-//+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinepools,verbs=get;list;watch;delete
+//+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinepools/status,verbs=get
+//+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters,verbs=get;list;watch;delete
+//+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters/status,verbs=get
 //+kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;create;patch
 //+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update