Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
controller-gen.kubebuilder.io/version: v0.17.2
name: mirrorpeers.multicluster.odf.openshift.io
spec:
group: multicluster.odf.openshift.io
Expand Down
48 changes: 15 additions & 33 deletions config/rbac/role.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,30 @@ metadata:
name: manager-role
rules:
- apiGroups:
- addon.open-cluster-management.io
- ""
resources:
- clustermanagementaddons
- managedclusteraddons
- configmaps
- events
- pods
- secrets
verbs:
- '*'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Limit the actions to just the required ones ? I don't think we require (get, delete, watch, patch, updates) for pods or events ?

Copy link
Contributor Author

@umangachapagain umangachapagain Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did not add these changes. The controller-gen update did some changes to this based on existing RBACs.
I have a task created to cleanup RBACs. I'll do it soon when the features are complete.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright

- apiGroups:
- addon.open-cluster-management.io
- ""
resources:
- managedclusteraddons/finalizers
- services
verbs:
- '*'
- create
- get
- list
- update
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here ? Do we perform all of these actions ?

- watch
- apiGroups:
- addon.open-cluster-management.io
resources:
- clustermanagementaddons
- managedclusteraddons
- managedclusteraddons/finalizers
- managedclusteraddons/status
verbs:
- '*'
Expand Down Expand Up @@ -75,33 +84,6 @@ rules:
- list
- update
- watch
- apiGroups:
- ""
resources:
- configmaps
- events
- pods
- secrets
verbs:
- '*'
- apiGroups:
- ""
resources:
- configmaps
- events
- secrets
verbs:
- '*'
- apiGroups:
- ""
resources:
- services
verbs:
- create
- get
- list
- update
- watch
- apiGroups:
- multicluster.odf.openshift.io
resources:
Expand Down
2 changes: 1 addition & 1 deletion hack/make/tools.mk
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ endef

CONTROLLER_GEN = $(CWD)/bin/controller-gen
controller-gen: ## Download controller-gen locally if necessary.
$(call go-get-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0)
$(call go-get-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.17.2)

KUSTOMIZE = $(CWD)/bin/kustomize
kustomize: ## Download kustomize locally if necessary.
Expand Down