wip

Signed-off-by: Massimiliano Giovagnoli <me@maxgio.it>

api/v1beta1/owner_role.go

@@ -40,21 +40,30 @@ func (in OwnerSpec) GetRoles(tenant Tenant, index int) []string {
 
 	roles := []string{"admin", "capsule-namespace-deleter"}
 
+	if tenant.Spec.GitOpsReady {
+		roles = append(roles, in.getGitOpsRoles(tenant)...)
+	}
+
 	return roles
 }
 
 func (in OwnerSpec) GetClusterRoles(tenant Tenant) []string {
 	if tenant.Spec.GitOpsReady {
-		return in.getGitOpsRoles(tenant)
+		return in.getGitOpsClusterRoles(tenant)
 	}
 
 	return []string{}
 }
 
+func (in OwnerSpec) getGitOpsClusterRoles(tenant Tenant) []string {
+	return []string{
+		"capsule-tenant-impersonator-" + tenant.Name + "-" + in.Name,
+	}
+}
+
 func (in OwnerSpec) getGitOpsRoles(tenant Tenant) []string {
 	return []string{
 		"cluster-admin",
-		"capsule-tenant-impersonator-" + tenant.Name + "-" + in.Name,
 	}
 }
 

api/v1beta1/tenant_labels.go

@@ -24,6 +24,8 @@ func GetTypeLabel(t runtime.Object) (label string, err error) {
 		return "capsule.clastix.io/resource-quota", nil
 	case *rbacv1.RoleBinding:
 		return "capsule.clastix.io/role-binding", nil
+	case *rbacv1.ClusterRoleBinding:
+		return "capsule.clastix.io/cluster-role-binding", nil
 	default:
 		err = fmt.Errorf("type %T is not mapped as Capsule label recognized", v)
 	}