From b2aa60829418cb1d5d0923a7c12765dbb26db7cf Mon Sep 17 00:00:00 2001
From: Adam Harrison <harrisonadamw@gmail.com>
Date: Tue, 5 Jun 2018 15:51:33 +0100
Subject: [PATCH] Update permissions for kubectl 1.9.6

The permissions required by `kubectl drain` vary from version
to version; this change brings them into line with the one currently
bundled.
---
 kured-rbac.yaml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/kured-rbac.yaml b/kured-rbac.yaml
index b48d650..6fad9e1 100644
--- a/kured-rbac.yaml
+++ b/kured-rbac.yaml
@@ -4,14 +4,21 @@ kind: ClusterRole
 metadata:
   name: kured
 rules:
-# Allow kured to cordon and uncordon nodes
+# Allow kured to read spec.unschedulable
+# Allow kubectl to drain/uncordon
+#
+# NB: These permissions are tightly coupled to the bundled version of kubectl; the ones below
+# match https://github.com/kubernetes/kubernetes/blob/v1.9.6/pkg/kubectl/cmd/drain.go
+#
 - apiGroups: [""]
   resources: ["nodes"]
-  verbs:     ["get", "update"]
-# Allow kured to drain nodes
+  verbs:     ["get", "patch"]
 - apiGroups: [""]
   resources: ["pods"]
-  verbs:     ["get", "list", "delete"]
+  verbs:     ["list"]
+- apiGroups: [""]
+  resources: ["replicationcontrollers"]
+  verbs:     ["get"]
 - apiGroups: ["apps"]
   resources: ["statefulsets"]
   verbs:     ["get"]