From 3008680c12c552d72987c0fab546a338af7f8940 Mon Sep 17 00:00:00 2001
From: Ludovic Piot <ludovic.piot@thegaragebandofit.com>
Date: Mon, 9 Jun 2025 20:26:44 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=82=20=F0=9F=90=9B=20fix=20permissions?=
 =?UTF-8?q?=20for=20persistentVolumes=20management?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/M6-rocky-cluster-role.yaml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/k8s/M6-rocky-cluster-role.yaml b/k8s/M6-rocky-cluster-role.yaml
index a2ab2f47..7297de15 100644
--- a/k8s/M6-rocky-cluster-role.yaml
+++ b/k8s/M6-rocky-cluster-role.yaml
@@ -8,3 +8,31 @@ rules:
 - apiGroups: ["", extensions, apps]
   resources: [deployments, replicasets, pods, services, ingresses, statefulsets]
   verbs: [get, list, watch, create, update, patch, delete] # You can also use [*]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rocky-pv-access
+rules:
+- apiGroups: [""]
+  resources: [persistentvolumes]
+  verbs: [get, list, watch, create, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    toolkit.fluxcd.io/tenant: rocky
+  name: rocky-reconciler2
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: rocky-pv-access
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: gotk:rocky-test:reconciler
+- kind: ServiceAccount
+  name: rocky
+  namespace: rocky-test
+  
\ No newline at end of file