Merge pull request #10173 from rmohr/leases

Move coordination/lease RBAC permissions to Roles
kubevirt · Aug 1, 2023 · feba51e · feba51e
2 parents 2041062 + fc82817
commit feba51e
Show file tree

Hide file tree

Showing 4 changed files with 70 additions and 70 deletions.
diff --git a/manifests/generated/operator-csv.yaml.in b/manifests/generated/operator-csv.yaml.in
@@ -185,18 +185,6 @@ spec:
           - update
           - delete
           - patch
-        - apiGroups:
-          - coordination.k8s.io
-          resources:
-          - leases
-          verbs:
-          - get
-          - list
-          - watch
-          - delete
-          - update
-          - create
-          - patch
         - apiGroups:
           - ""
           resources:
@@ -535,18 +523,6 @@ spec:
           - update
           - create
           - patch
-        - apiGroups:
-          - coordination.k8s.io
-          resources:
-          - leases
-          verbs:
-          - get
-          - list
-          - watch
-          - delete
-          - update
-          - create
-          - patch
         - apiGroups:
           - ""
           resources:
@@ -787,6 +763,18 @@ spec:
           - list
           - get
           - watch
+        - apiGroups:
+          - coordination.k8s.io
+          resources:
+          - leases
+          verbs:
+          - get
+          - list
+          - watch
+          - delete
+          - update
+          - create
+          - patch
         - apiGroups:
           - kubevirt.io
           resources:
@@ -1440,6 +1428,18 @@ spec:
           - routes/custom-host
           verbs:
           - create
+        - apiGroups:
+          - coordination.k8s.io
+          resources:
+          - leases
+          verbs:
+          - get
+          - list
+          - watch
+          - delete
+          - update
+          - create
+          - patch
         serviceAccountName: kubevirt-operator
     strategy: deployment
   installModes:

diff --git a/manifests/generated/rbac-operator.authorization.k8s.yaml.in b/manifests/generated/rbac-operator.authorization.k8s.yaml.in
@@ -63,6 +63,18 @@ rules:
   - routes/custom-host
   verbs:
   - create
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+  - update
+  - create
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -113,18 +125,6 @@ rules:
   - update
   - delete
   - patch
-- apiGroups:
-  - coordination.k8s.io
-  resources:
-  - leases
-  verbs:
-  - get
-  - list
-  - watch
-  - delete
-  - update
-  - create
-  - patch
 - apiGroups:
   - ""
   resources:
@@ -463,18 +463,6 @@ rules:
   - update
   - create
   - patch
-- apiGroups:
-  - coordination.k8s.io
-  resources:
-  - leases
-  verbs:
-  - get
-  - list
-  - watch
-  - delete
-  - update
-  - create
-  - patch
 - apiGroups:
   - ""
   resources:
@@ -715,6 +703,18 @@ rules:
   - list
   - get
   - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+  - update
+  - create
+  - patch
 - apiGroups:
   - kubevirt.io
   resources:

diff --git a/pkg/virt-operator/resource/generate/rbac/controller.go b/pkg/virt-operator/resource/generate/rbac/controller.go
@@ -113,6 +113,17 @@ func newControllerRole(namespace string) *rbacv1.Role {
 					"watch",
 				},
 			},
+			{
+				APIGroups: []string{
+					"coordination.k8s.io",
+				},
+				Resources: []string{
+					"leases",
+				},
+				Verbs: []string{
+					"get", "list", "watch", "delete", "update", "create", "patch",
+				},
+			},
 		},
 	}
 }
@@ -194,17 +205,6 @@ func newControllerClusterRole() *rbacv1.ClusterRole {
 					"get", "list", "watch", "delete", "update", "create", "patch",
 				},
 			},
-			{
-				APIGroups: []string{
-					"coordination.k8s.io",
-				},
-				Resources: []string{
-					"leases",
-				},
-				Verbs: []string{
-					"get", "list", "watch", "delete", "update", "create", "patch",
-				},
-			},
 			{
 				APIGroups: []string{
 					"",

diff --git a/pkg/virt-operator/resource/generate/rbac/operator.go b/pkg/virt-operator/resource/generate/rbac/operator.go
@@ -119,17 +119,6 @@ func NewOperatorClusterRole() *rbacv1.ClusterRole {
 					"patch",
 				},
 			},
-			{
-				APIGroups: []string{
-					"coordination.k8s.io",
-				},
-				Resources: []string{
-					"leases",
-				},
-				Verbs: []string{
-					"get", "list", "watch", "delete", "update", "create", "patch",
-				},
-			},
 			{
 				APIGroups: []string{
 					"",
@@ -540,6 +529,17 @@ func NewOperatorRole(namespace string) *rbacv1.Role {
 					"create",
 				},
 			},
+			{
+				APIGroups: []string{
+					"coordination.k8s.io",
+				},
+				Resources: []string{
+					"leases",
+				},
+				Verbs: []string{
+					"get", "list", "watch", "delete", "update", "create", "patch",
+				},
+			},
 		},
 	}
 }