Merge pull request #274 from JoelSpeed/azure-fine-grained-role

OCPCLOUD-2013: Move Azure Credentials Request to custom role
openshift · Aug 15, 2023 · 786dda4 · 786dda4
2 parents 1bcc8b7 + 53dbc5a
commit 786dda4
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/manifests/0000_26_cloud-controller-manager-operator_14_credentialsrequest-azure.yaml b/manifests/0000_26_cloud-controller-manager-operator_14_credentialsrequest-azure.yaml
@@ -13,7 +13,15 @@ spec:
   providerSpec:
     apiVersion: cloudcredential.openshift.io/v1
     kind: AzureProviderSpec
-    roleBindings:
-      - role: Contributor
+    permissions:
+    - Microsoft.Compute/virtualMachines/read
+    - Microsoft.Network/loadBalancers/read
+    - Microsoft.Network/loadBalancers/write
+    - Microsoft.Network/networkInterfaces/read
+    - Microsoft.Network/networkSecurityGroups/read
+    - Microsoft.Network/networkSecurityGroups/write
+    - Microsoft.Network/publicIPAddresses/join/action
+    - Microsoft.Network/publicIPAddresses/read
+    - Microsoft.Network/publicIPAddresses/write
   serviceAccountNames:
   - cloud-controller-manager