Merge pull request #18 from pdettori/fix-rbac

🐛 fix rbac for shadow pods
kubestellar · Jul 9, 2024 · 91308f1 · 91308f1
2 parents a460780 + 1a31f27
commit 91308f1
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 7 deletions.
diff --git a/charts/shadow-pods/templates/manager_role.yaml b/charts/shadow-pods/templates/manager_role.yaml
@@ -52,10 +52,13 @@ rules:
   - argoproj.io
   resources:
   - workflows
+  - workflows/finalizers
   verbs:
   - get
   - list
   - watch
+  - update
+  - patch
 - apiGroups:
   - ""
   resources:

diff --git a/shadow-pods/config/rbac/role.yaml b/shadow-pods/config/rbac/role.yaml
@@ -1,11 +1,27 @@
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  labels:
-    app.kubernetes.io/name: shadow-pods
-    app.kubernetes.io/managed-by: kustomize
   name: manager-role
 rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - argoproj.io
+  resources:
+  - workflows
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
diff --git a/shadow-pods/internal/controller/workflow_controller.go b/shadow-pods/internal/controller/workflow_controller.go
@@ -62,7 +62,7 @@ type PodInfo struct {
 	Phase     v1alpha1.NodePhase
 }
 
-//+kubebuilder:rbac:groups=argoproj.io,resources=workflows,verbs=get;list;watch;update;patch
+//+kubebuilder:rbac:groups=argoproj.io,resources=workflows;workflows/finalizers,verbs=get;list;watch;update;patch
 //+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to