mirror of
https://github.com/open-cluster-management-io/ocm.git
synced 2026-02-14 10:00:11 +00:00
5bac053fe0
Some checks failed
Scorecard supply-chain security / Scorecard analysis (push) Failing after 2m2s
Post / coverage (push) Failing after 39m59s
Post / images (amd64, addon-manager) (push) Failing after 8m42s
Post / images (amd64, placement) (push) Failing after 7m45s
Post / images (amd64, registration) (push) Failing after 7m51s
Post / images (amd64, registration-operator) (push) Failing after 7m38s
Post / images (amd64, work) (push) Failing after 7m44s
Post / images (arm64, addon-manager) (push) Failing after 7m51s
Post / images (arm64, placement) (push) Failing after 7m48s
Post / images (arm64, registration) (push) Failing after 7m55s
Post / images (arm64, registration-operator) (push) Failing after 7m49s
Post / images (arm64, work) (push) Failing after 7m50s
Post / image manifest (addon-manager) (push) Has been skipped
Post / image manifest (placement) (push) Has been skipped
Post / image manifest (registration) (push) Has been skipped
Post / image manifest (registration-operator) (push) Has been skipped
Post / image manifest (work) (push) Has been skipped
Post / trigger clusteradm e2e (push) Has been skipped
Close stale issues and PRs / stale (push) Successful in 54s
Signed-off-by: Wei Liu <liuweixa@redhat.com>
71 lines
2.9 KiB
YAML
71 lines
2.9 KiB
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: open-cluster-management:{{ .ClusterManagerName }}-addon-manager:controller
|
|
labels:
|
|
{{ if gt (len .Labels) 0 }}
|
|
{{ range $key, $value := .Labels }}
|
|
"{{ $key }}": "{{ $value }}"
|
|
{{ end }}
|
|
{{ end }}
|
|
rules:
|
|
# Allow controller to get/list/watch/create/delete configmaps/events
|
|
- apiGroups: [""]
|
|
resources: ["configmaps", "events"]
|
|
verbs: ["get", "list", "watch", "create", "update", "delete", "deletecollection", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["replicasets"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
- apiGroups: ["authorization.k8s.io"]
|
|
resources: ["subjectaccessreviews"]
|
|
verbs: ["get", "create"]
|
|
# Allow controller to manage managedclusters/placements/placementdecisions
|
|
- apiGroups: ["cluster.open-cluster-management.io"]
|
|
resources: ["managedclusters", "placements", "placementdecisions"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Allow controller to manage managedclusteraddons/clustermanagementaddons/addontemplates/addondeploymentconfigs
|
|
- apiGroups: ["addon.open-cluster-management.io"]
|
|
resources: ["managedclusteraddons/finalizers"]
|
|
verbs: ["update"]
|
|
- apiGroups: [ "addon.open-cluster-management.io" ]
|
|
resources: [ "clustermanagementaddons/finalizers" ]
|
|
verbs: [ "update" ]
|
|
- apiGroups: [ "addon.open-cluster-management.io" ]
|
|
resources: [ "clustermanagementaddons/status" ]
|
|
verbs: ["update", "patch"]
|
|
- apiGroups: ["addon.open-cluster-management.io"]
|
|
resources: ["clustermanagementaddons"]
|
|
verbs: ["patch", "get", "list", "watch"]
|
|
- apiGroups: ["addon.open-cluster-management.io"]
|
|
resources: ["managedclusteraddons"]
|
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
|
- apiGroups: ["addon.open-cluster-management.io"]
|
|
resources: ["managedclusteraddons/status"]
|
|
verbs: ["update", "patch"]
|
|
- apiGroups: ["addon.open-cluster-management.io"]
|
|
resources: ["addontemplates", "addondeploymentconfigs"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Allow controller to manage manifestworks
|
|
- apiGroups: ["work.open-cluster-management.io"]
|
|
resources: ["manifestworks"]
|
|
verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
|
|
# addon template controller needs these permissions to approve CSR and sign CA
|
|
- apiGroups: ["certificates.k8s.io"]
|
|
resources: ["certificatesigningrequests"]
|
|
verbs: ["create", "get", "list", "watch"]
|
|
- apiGroups: ["certificates.k8s.io"]
|
|
resources: ["certificatesigningrequests/approval", "certificatesigningrequests/status"]
|
|
verbs: ["update"]
|
|
- apiGroups: ["certificates.k8s.io"]
|
|
resources: ["signers"]
|
|
verbs: ["approve", "sign"]
|
|
- apiGroups: ["rbac.authorization.k8s.io"]
|
|
resources: ["rolebindings"]
|
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|