Broaden team controller rbac permissions

Adds support for external-secrets, prometheus, sloth
SambaTV · Mar 6, 2023 · 82ec873 · 82ec873
1 parent 910eaa8
commit 82ec873
Show file tree

Hide file tree

Showing 4 changed files with 87 additions and 1 deletion.
diff --git a/charts/spaces-operator/templates/rbac.yaml b/charts/spaces-operator/templates/rbac.yaml
@@ -177,6 +177,35 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - external-secrets.io
+  resources:
+  - externalsecrets
+  - secretstores
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - alertmanagerconfigs
+  - alertmanagers
+  - podmonitors
+  - probes
+  - servicemonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - networking.k8s.io
   resources:
@@ -217,6 +246,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - sloth.slok.dev
+  resources:
+  - prometheusservicelevels
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - spaces.samba.tv
   resources:
@@ -273,3 +314,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: spaces-operator-controller-manager
+  namespace: {{ .Release.Namespace }}
diff --git a/charts/spaces-operator/values.yaml b/charts/spaces-operator/values.yaml
@@ -90,4 +90,4 @@ podDisruptionBudget:
   enabled: true
 
 prometheus:
-  enabled: false
+  enabled: true
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -129,6 +129,35 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - external-secrets.io
+  resources:
+  - externalsecrets
+  - secretstores
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - alertmanagerconfigs
+  - alertmanagers
+  - podmonitors
+  - probes
+  - servicemonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - networking.k8s.io
   resources:
@@ -169,6 +198,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - sloth.slok.dev
+  resources:
+  - prometheusservicelevels
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - spaces.samba.tv
   resources:

diff --git a/controllers/v1beta1/team_controller.go b/controllers/v1beta1/team_controller.go
@@ -49,6 +49,9 @@ type TeamReconciler struct {
 // +kubebuilder:rbac:groups=batch,resources=cronjobs;cronjobs/status;jobs;jobs/status,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;roles;rolebindings,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=networking.k8s.io,resources=ingressclasses;ingresses;ingresses/status,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=external-secrets.io,resources=externalsecrets;secretstores,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=monitoring.coreos.com,resources=alertmanagers;alertmanagerconfigs;podmonitors;probes;servicemonitors,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=sloth.slok.dev,resources=prometheusservicelevels,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=spaces.samba.tv,resources=teams,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=spaces.samba.tv,resources=teams/status,verbs=get;update;patch