Merge pull request #2793 from vpnachev/rbac/adminstrator

Allow administrator to list namespaces and manage RBACs and admission webhooks
gardener · Aug 31, 2020 · 51ee00b · 51ee00b
2 parents 97e2874 + 8abb655
commit 51ee00b
Showing 1 changed file with 23 additions and 1 deletion.
diff --git a/charts/gardener/controlplane/charts/application/templates/rbac-user.yaml b/charts/gardener/controlplane/charts/application/templates/rbac-user.yaml
@@ -21,7 +21,29 @@ rules:
   resources:
   - namespaces
   verbs:
-  - get
+  - '*'
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  - clusterrolebindings
+  - roles
+  - rolebindings
+  verbs:
+  - '*'
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
+  verbs:
+  - '*'
+- apiGroups:
+  - apiregistration.k8s.io
+  resources:
+  - apiservices
+  verbs:
+  - '*'
 
 # Aggregated cluster role specifying garden administrators.
 # IMPORTANT: You need to define a corresponding ClusterRoleBinding binding specific users