fix: remove dependency on cluster-admin

kubeovn · Jul 9, 2019 · 8736729 · 8736729
1 parent dee797f
commit 8736729
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 55 deletions.
diff --git a/yamls/cm.yaml b/yamls/cm.yaml
diff --git a/yamls/ovn.yaml b/yamls/ovn.yaml
@@ -23,24 +23,28 @@ kind: ClusterRole
 metadata:
   annotations:
     rbac.authorization.k8s.io/system-only: "true"
-  name: system:ovn-reader
+  name: system:ovn
 rules:
   - apiGroups:
       - ""
-      - extensions
     resources:
       - pods
       - namespaces
-      - networkpolicies
       - nodes
+      - configmaps
     verbs:
       - get
       - list
       - watch
+      - patch
+      - update
   - apiGroups:
+      - ""
       - networking.k8s.io
     resources:
       - networkpolicies
+      - services
+      - endpoints
     verbs:
       - get
       - list
@@ -58,37 +62,9 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: ovn-cluster-reader
-roleRef:
-  name: cluster-reader
-  kind: ClusterRole
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: ovn
-    namespace: kube-ovn
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ovn-reader
-roleRef:
-  name: system:ovn-reader
-  kind: ClusterRole
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: ovn
-    namespace: kube-ovn
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cluster-admin-0
+  name: ovn
 roleRef:
-  name: cluster-admin
+  name: system:ovn
   kind: ClusterRole
   apiGroup: rbac.authorization.k8s.io
 subjects: