From ba29d0a608a86cd4e1d1574d41ff60ce9acf51d2 Mon Sep 17 00:00:00 2001
From: Mattias Gees <mattias.gees@gmail.com>
Date: Fri, 13 Apr 2018 22:58:59 +0200
Subject: [PATCH] Kube-spot has to be able to run kubectl drain (#4730)

* Kube-spot has to be able to run kubectl drain

One of the main functions of kube-spot is running the kubectl drain command. This needs more extensive rights to kubernetes. It has to be able to list everything running on a node + evict those things.

* Bump chart
---
 .../Chart.yaml                                |  2 +-
 .../templates/rbac.yaml                       | 30 ++++++++++++++++++-
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/incubator/kube-spot-termination-notice-handler/Chart.yaml b/incubator/kube-spot-termination-notice-handler/Chart.yaml
index 0ec49b0ef6..1f223ef931 100644
--- a/incubator/kube-spot-termination-notice-handler/Chart.yaml
+++ b/incubator/kube-spot-termination-notice-handler/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Watch and action AWS spot termination events
 name: kube-spot-termination-notice-handler
-version: 0.2.0
+version: 0.2.1
 appVersion: 1.8.1-1
 home: https://github.com/egeland/kube-spot-termination-notice-handler
 source:
diff --git a/incubator/kube-spot-termination-notice-handler/templates/rbac.yaml b/incubator/kube-spot-termination-notice-handler/templates/rbac.yaml
index d01ab5b2c7..9ff2517243 100644
--- a/incubator/kube-spot-termination-notice-handler/templates/rbac.yaml
+++ b/incubator/kube-spot-termination-notice-handler/templates/rbac.yaml
@@ -34,5 +34,33 @@ rules:
   verbs:
   - get
   - list
-  - watch
+- apiGroups:
+  - extensions
+  resources:
+  - replicasets
+  - daemonsets
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - pods/eviction
+  verbs:
+  - create
 {{- end -}}