software-engineering/zitadel-k8s-operator
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix rbac

Browse Source 
[ZITADOPER-1]
This commit is contained in:
Haim Kortovich
2024-05-06 15:31:47 -05:00
parent 46601c4186
commit da898abe32
3 changed files with 359 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

179
ops/chart/templates/manager-rbac.yaml
View File

@@ -5,6 +5,159 @@ metadata:
labels: labels:
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }} {{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
rules: rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- create
- get
- list
- patch
- watch
- apiGroups:
- ""
resources:
- endpoints
verbs:
- create
- get
- list
- patch
- watch
- apiGroups:
- ""
resources:
- endpoints/restricted
verbs:
- create
- get
- list
- patch
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- list
- patch
- watch
- apiGroups:
- ""
resources:
- pods
verbs:
- delete
- get
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- list
- patch
- watch
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- create
- list
- patch
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- create
- list
- patch
- watch
- apiGroups:
- apps
resources:
- deployments
verbs:
- create
- list
- patch
- watch
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests
verbs:
- create
- delete
- get
- list
- patch
- watch
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests/approval
verbs:
- update
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests/status
verbs:
- get
- patch
- update
- apiGroups:
- crdb.cockroachlabs.com
resources:
- crdbclusters
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- crdb.cockroachlabs.com
resources:
- crdbclusters/finalizers
verbs:
- update
- apiGroups:
- crdb.cockroachlabs.com
resources:
- crdbclusters/status
verbs:
- get
- patch
- update
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- create
- list
- patch
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterrolebindings
- rolebindings
- roles
verbs:
- create
- list
- patch
- watch
- apiGroups: - apiGroups:
- zitadel.topmanage.com - zitadel.topmanage.com
resources: resources:
@@ -83,6 +236,32 @@ rules:
- get - get
- patch - patch
- update - update
- apiGroups:
- zitadel.topmanage.com
resources:
- zitadelclusters
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- zitadel.topmanage.com
resources:
- zitadelclusters/finalizers
verbs:
- update
- apiGroups:
- zitadel.topmanage.com
resources:
- zitadelclusters/status
verbs:
- get
- patch
- update
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding

179
src/config/rbac/role.yaml
View File

@@ -5,6 +5,159 @@ metadata:
creationTimestamp: null creationTimestamp: null
name: manager-role name: manager-role
rules: rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- create
- get
- list
- patch
- watch
- apiGroups:
- ""
resources:
- endpoints
verbs:
- create
- get
- list
- patch
- watch
- apiGroups:
- ""
resources:
- endpoints/restricted
verbs:
- create
- get
- list
- patch
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- list
- patch
- watch
- apiGroups:
- ""
resources:
- pods
verbs:
- delete
- get
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- list
- patch
- watch
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- create
- list
- patch
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- create
- list
- patch
- watch
- apiGroups:
- apps
resources:
- deployments
verbs:
- create
- list
- patch
- watch
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests
verbs:
- create
- delete
- get
- list
- patch
- watch
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests/approval
verbs:
- update
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests/status
verbs:
- get
- patch
- update
- apiGroups:
- crdb.cockroachlabs.com
resources:
- crdbclusters
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- crdb.cockroachlabs.com
resources:
- crdbclusters/finalizers
verbs:
- update
- apiGroups:
- crdb.cockroachlabs.com
resources:
- crdbclusters/status
verbs:
- get
- patch
- update
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- create
- list
- patch
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterrolebindings
- rolebindings
- roles
verbs:
- create
- list
- patch
- watch
- apiGroups: - apiGroups:
- zitadel.topmanage.com - zitadel.topmanage.com
resources: resources:
@@ -83,3 +236,29 @@ rules:
- get - get
- patch - patch
- update - update
- apiGroups:
- zitadel.topmanage.com
resources:
- zitadelclusters
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- zitadel.topmanage.com
resources:
- zitadelclusters/finalizers
verbs:
- update
- apiGroups:
- zitadel.topmanage.com
resources:
- zitadelclusters/status
verbs:
- get
- patch
- update

1
src/internal/controller/zitadelcluster_controller.go
View File

@@ -95,6 +95,7 @@ type ZitadelClusterReconciler struct {
// +kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests,verbs=get;list;watch;create;patch;delete // +kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests,verbs=get;list;watch;create;patch;delete
// +kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests/status,verbs=get;update;patch // +kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests/approval,verbs=update // +kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests/approval,verbs=update
func (r *ZitadelClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { func (r *ZitadelClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
logger := log.FromContext(ctx) logger := log.FromContext(ctx)
logger.Info("Starting Reconcile") logger.Info("Starting Reconcile")