Move Azure Credentials Request to custom role

openshift · Aug 11, 2023 · 53dbc5a · 53dbc5a
1 parent 1bcc8b7
commit 53dbc5a
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/manifests/0000_26_cloud-controller-manager-operator_14_credentialsrequest-azure.yaml b/manifests/0000_26_cloud-controller-manager-operator_14_credentialsrequest-azure.yaml
@@ -13,7 +13,15 @@ spec:
   providerSpec:
     apiVersion: cloudcredential.openshift.io/v1
     kind: AzureProviderSpec
-    roleBindings:
-      - role: Contributor
+    permissions:
+    - Microsoft.Compute/virtualMachines/read
+    - Microsoft.Network/loadBalancers/read
+    - Microsoft.Network/loadBalancers/write
+    - Microsoft.Network/networkInterfaces/read
+    - Microsoft.Network/networkSecurityGroups/read
+    - Microsoft.Network/networkSecurityGroups/write
+    - Microsoft.Network/publicIPAddresses/join/action
+    - Microsoft.Network/publicIPAddresses/read
+    - Microsoft.Network/publicIPAddresses/write
   serviceAccountNames:
   - cloud-controller-manager