Merge pull request #7 from mercedes-benz/fix_rbac

fix: garm-server is not able to create runner namespace
mercedes-benz · Dec 11, 2023 · d756101 · d756101
2 parents 962d3dc + aed0f1b
commit d756101
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 8 deletions.
diff --git a/hack/local-development/kubernetes/clusterrole-binding.yaml b/hack/local-development/kubernetes/clusterrole-binding.yaml
@@ -4,13 +4,13 @@ apiVersion: rbac.authorization.k8s.io/v1
 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
 kind: RoleBinding
 metadata:
-  name: garm-server
+  name: garm-provider-k8s
   namespace: runner
 subjects:
   - kind: ServiceAccount
     namespace: garm-server
     name: garm-server
 roleRef:
-  kind: Role
-  name: garm-server
+  kind: ClusterRole
+  name: garm-provider-k8s
   apiGroup: rbac.authorization.k8s.io
diff --git a/hack/local-development/kubernetes/clusterrole.yaml b/hack/local-development/kubernetes/clusterrole.yaml
@@ -1,11 +1,11 @@
-# SPDX-License-Identifier: MIT
-
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
-  name: garm-server
-  namespace: runner
+  name: garm-provider-k8s
 rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
   - apiGroups: [""]
     resources: ["pods"]
     verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]