fix rbac role issue (#3753)

Signed-off-by: chenqiming <whqscqm@outlook.com>

charts/fluid/fluid/templates/role/alluxio/rbac.yaml

@@ -105,7 +105,13 @@ rules:
       - alluxioruntimes/status
       - datasets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -114,13 +120,39 @@ rules:
       - daemonsets/status
       - statefulsets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: alluxioruntime-controller
+rules:
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
     verbs:
-      - '*'
+      - create
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    resourceNames:
+      - alluxio.data.fluid.io
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -135,6 +167,20 @@ subjects:
     name: alluxioruntime-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: alluxioruntime-controller
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: alluxioruntime-controller
+subjects:
+  - kind: ServiceAccount
+    name: alluxioruntime-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

charts/fluid/fluid/templates/role/dataset/rbac.yaml

@@ -100,7 +100,13 @@ rules:
       - efcruntimes
       - efcruntimes/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -109,7 +115,13 @@ rules:
       - daemonsets/status
       - statefulsets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -122,12 +134,32 @@ rules:
       - 'watch'
       - 'update'
       - 'patch'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: dataset-controller
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - create
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - dataset.data.fluid.io
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -142,6 +174,20 @@ subjects:
     name: dataset-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: dataset-controller
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: dataset-controller
+subjects:
+  - kind: ServiceAccount
+    name: dataset-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

charts/fluid/fluid/templates/role/efc/rbac.yaml

@@ -104,7 +104,13 @@ rules:
       - efcruntimes/status
       - datasets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -113,13 +119,39 @@ rules:
       - daemonsets/status
       - statefulsets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: efcruntime-controller
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - create
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - efc.data.fluid.io
     verbs:
-      - "*"
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -134,6 +166,20 @@ subjects:
     name: efcruntime-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: efcruntime-rolebinding
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: efcruntime-controller
+subjects:
+  - kind: ServiceAccount
+    name: efcruntime-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

charts/fluid/fluid/templates/role/fluidapp/rbac.yaml

@@ -38,13 +38,39 @@ rules:
     resources:
       - configmaps
     verbs:
-      - "*"
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: fluidapp-controller
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - create
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - fluidapp.data.fluid.io
     verbs:
-      - "*"
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -59,6 +85,20 @@ subjects:
     name: fluidapp-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: fluidapp-controller
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: fluidapp-controller
+subjects:
+  - kind: ServiceAccount
+    name: fluidapp-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

charts/fluid/fluid/templates/role/goosefs/rbac.yaml

@@ -105,7 +105,13 @@ rules:
       - goosefsruntimes/status
       - datasets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -114,13 +120,39 @@ rules:
       - daemonsets/status
       - statefulsets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: goosefsruntime-controller
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - create
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - goosefs.data.fluid.io
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -135,6 +167,20 @@ subjects:
     name: goosefsruntime-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: goosefsruntime-rolebinding
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: goosefsruntime-controller
+subjects:
+  - kind: ServiceAccount
+    name: goosefsruntime-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata: