yaml-spec: update rules to be more granular.

romana · Apr 26, 2017 · fc0e83c · fc0e83c
1 parent ba8c8b6
commit fc0e83c
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 9 deletions.
diff --git a/containerize/specs/romana-kubeadm.yml b/containerize/specs/romana-kubeadm.yml
@@ -10,14 +10,11 @@ rules:
   - pods
   - namespaces
   - nodes
-  - services
   - endpoints
   verbs:
   - get
   - list
   - watch
-  - update
-  - create
 - apiGroups:
   - extensions
   resources:
@@ -26,6 +23,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - "*"
+  resources:
+  - services
+  verbs:
+  - update
+  - list
+  - watch
 ---
 apiVersion: v1
 kind: ServiceAccount

diff --git a/romana-install/roles/stack/kubeadm/postinstall/files/romana-kubeadm.yml b/romana-install/roles/stack/kubeadm/postinstall/files/romana-kubeadm.yml
@@ -10,14 +10,11 @@ rules:
   - pods
   - namespaces
   - nodes
-  - services
   - endpoints
   verbs:
   - get
   - list
   - watch
-  - update
-  - create
 - apiGroups:
   - extensions
   resources:
@@ -26,6 +23,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - "*"
+  resources:
+  - services
+  verbs:
+  - update
+  - list
+  - watch
 ---
 apiVersion: v1
 kind: ServiceAccount

diff --git a/romana-install/roles/stack/kubeadm/postinstall/templates/romana-localbuild.yml b/romana-install/roles/stack/kubeadm/postinstall/templates/romana-localbuild.yml
@@ -10,14 +10,11 @@ rules:
   - pods
   - namespaces
   - nodes
-  - services
   - endpoints
   verbs:
   - get
   - list
   - watch
-  - update
-  - create
 - apiGroups:
   - extensions
   resources:
@@ -26,6 +23,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - "*"
+  resources:
+  - services
+  verbs:
+  - update
+  - list
+  - watch
 ---
 apiVersion: v1
 kind: ServiceAccount