Fix rbac permissions

Makefile

@@ -49,7 +49,7 @@ help: ## Display this help.
 .PHONY: manifests
 manifests: controller-gen ## Generate rbac objects.
 	# onmetal-api-net
-	$(CONTROLLER_GEN) rbac:roleName=manager-role paths="./internal/controllers/..." output:rbac:artifacts:config=config/onmetal-api-net/rbac
+	$(CONTROLLER_GEN) rbac:roleName=manager-role paths="./internal/controllers/..." output:rbac:artifacts:config=config/controller/rbac
 
 	# apinetlet
 	$(CONTROLLER_GEN) rbac:roleName=manager-role paths="./apinetlet/controllers/..." output:rbac:artifacts:config=config/apinetlet/rbac
@@ -60,8 +60,8 @@ manifests: controller-gen ## Generate rbac objects.
 	CONTROLLER_GEN=$(CONTROLLER_GEN) ./hack/cluster-controller-gen.sh cluster=metalnet rbac:roleName=metalnet-role paths="./metalnetlet/controllers/..." output:rbac:artifacts:config=config/metalnetlet/metalnet-rbac
 
 	# Promote *let roles.
-	./hack/promote-let-role.sh config/apinetlet/apinet-rbac/role.yaml config/onmetal-api-net/rbac/apinetlet_role.yaml apinet.api.onmetal.de:system:apinetlets
-	./hack/promote-let-role.sh config/metalnetlet/metalnet-rbac/role.yaml config/onmetal-api-net/rbac/metalnetlet_role.yaml apinet.api.onmetal.de:system:metalnetlet
+	./hack/promote-let-role.sh config/apinetlet/apinet-rbac/role.yaml config/apiserver/rbac/apinetlet_role.yaml apinet.api.onmetal.de:system:apinetlets
+	./hack/promote-let-role.sh config/metalnetlet/metalnet-rbac/role.yaml config/apiserver/rbac/metalnetlet_role.yaml apinet.api.onmetal.de:system:metalnetlet
 
 .PHONY: generate
 generate: vgopath models-schema deepcopy-gen client-gen lister-gen informer-gen defaulter-gen conversion-gen openapi-gen applyconfiguration-gen

config/apiserver/rbac/bucketpool_bootstrapper_role.yaml → config/apiserver/rbac/apinetlet_bootstrapper_role.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: storage.api.onmetal.de:system:bucketpools-bootstrapper
+  name: apinet.api.onmetal.de:system:apinetlets-bootstrapper
 rules:
   - apiGroups:
       - certificates.k8s.io
@@ -15,6 +15,6 @@ rules:
   - apiGroups:
       - certificates.k8s.io
     resources:
-      - certificatesigningrequests/bucketpoolclient
+      - certificatesigningrequests/apinetletclient
     verbs:
       - create

config/apiserver/rbac/volumepool_bootstrapper_rolebinding.yaml → config/apiserver/rbac/apinetlet_bootstrapper_rolebinding.yaml

@@ -1,14 +1,14 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: storage.api.onmetal.de:system:volumepools-bootstrapper
+  name: apinet.api.onmetal.de:system:apinetlets-bootstrapper
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: storage.api.onmetal.de:system:volumepools-bootstrapper
+  name: apinet.api.onmetal.de:system:apinetlets-bootstrapper
 subjects:
   - kind: Group
     # Group name has to match bootstrap group pattern \Asystem:bootstrappers:[a-z0-9:-]{0,255}[a-z0-9]\
     # See https://github.com/kubernetes/kubernetes/blob/e8662a46dd27db774ec953dae15f93ae2d1a68c8/staging/src/k8s.io/cluster-bootstrap/token/api/types.go#L96
-    name: system:bootstrappers:storage-api-onmetal-de:volumepools
+    name: system:bootstrappers:apinet-api-onmetal-de:apinetlets
     apiGroup: rbac.authorization.k8s.io

config/apiserver/rbac/volumepool_rolebinding.yaml → config/apiserver/rbac/apinetlet_rolebinding.yaml

@@ -1,12 +1,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: storage.api.onmetal.de:system:volumepools
+  name: apinet.api.onmetal.de:system:apinetlets
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: storage.api.onmetal.de:system:volumepools
+  name: apinet.api.onmetal.de:system:apinetlets
 subjects:
   - kind: Group
-    name: storage.api.onmetal.de:system:volumepools
+    name: apinet.api.onmetal.de:system:apinetlets
     apiGroup: rbac.authorization.k8s.io

config/apiserver/rbac/apiserver_role.yaml

@@ -12,20 +12,6 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - compute.api.onmetal.de
-    resources:
-      - machinepools/proxy
-    verbs:
-      - '*'
-  - apiGroups:
-      - compute.api.onmetal.de
-    resources:
-      - machinepools
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - admissionregistration.k8s.io
     resources:

config/apiserver/rbac/kustomization.yaml

@@ -5,26 +5,14 @@ resources:
   - apiserver_role.yaml
   - apiserver_role_binding.yaml
 
-  # MachinePool (bootstrapper) roles
-  - machinepool_role.yaml
-  - machinepool_rolebinding.yaml
-  - machinepool_bootstrapper_role.yaml
-  - machinepool_bootstrapper_rolebinding.yaml
+  # APINetlet (bootstrapper) roles
+  - apinetlet_role.yaml
+  - apinetlet_rolebinding.yaml
+  - apinetlet_bootstrapper_role.yaml
+  - apinetlet_bootstrapper_rolebinding.yaml
 
-  # VolumePool (bootstrapper) roles
-  - volumepool_role.yaml
-  - volumepool_rolebinding.yaml
-  - volumepool_bootstrapper_role.yaml
-  - volumepool_bootstrapper_rolebinding.yaml
-
-  # BucketPool (bootstrapper) roles
-  - bucketpool_role.yaml
-  - bucketpool_rolebinding.yaml
-  - bucketpool_bootstrapper_role.yaml
-  - bucketpool_bootstrapper_rolebinding.yaml
-
-  # Network Plugin (bootstrapper) roles
-  - networkplugin_role.yaml
-  - networkplugin_rolebinding.yaml
-  - networkplugin_bootstrapper_role.yaml
-  - networkplugin_bootstrapper_rolebinding.yaml
+  # Metalnetlet (bootstrapper) roles
+  - metalnetlet_role.yaml
+  - metalnetlet_rolebinding.yaml
+  - metalnetlet_bootstrapper_role.yaml
+  - metalnetlet_bootstrapper_rolebinding.yaml