Merge pull request #1336 from tu1h/fix_role_privilege

Fix role privilege
kubean-io · Aug 8, 2024 · de6f8a8 · de6f8a8
2 parents 5c67b3a + a7a46f3
commit de6f8a8
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/charts/kubean/templates/clusterrole.yaml b/charts/kubean/templates/clusterrole.yaml
@@ -5,7 +5,7 @@ metadata:
   name: {{ $name }}
 rules:
   - apiGroups: [ 'kubean.io' ]
-    resources: [ 'clusteroperations','clusteroperations/status','clusters','clusters/status','localartifactsets','localartifactsets/status','manifests','manifest/status' ]
+    resources: [ 'clusteroperations','clusteroperations/status','clusters','clusters/status','localartifactsets','localartifactsets/status','manifests','manifests/status' ]
     verbs: [ '*' ]
   - apiGroups: [ 'admissionregistration.k8s.io' ]
     resources: [ 'validatingwebhookconfigurations' ]

diff --git a/charts/kubean/templates/role.yaml b/charts/kubean/templates/role.yaml
@@ -10,7 +10,7 @@ rules:
     verbs: [ 'list' ]
   - apiGroups: [ '' ]
     resources: [ 'configmaps','secrets' ]
-    verbs: [ "get", "create", "update" ]
+    verbs: [ "get", "create", "update", "delete" ]
   - apiGroups: [ '' ]
     resources: [ 'events' ]
     verbs: [ "create" ]
@@ -20,4 +20,7 @@ rules:
   - apiGroups: [ 'coordination.k8s.io' ]
     resources: [ 'leases' ]
     resourceNames: [ 'kubean-controller', 'lease-for-kubean-webhook-ca-create' ]
-    verbs: [ "get", "create", "update", "delete" ]
+    verbs: [ "get", "update" ]
+  - apiGroups: [ 'coordination.k8s.io' ]
+    resources: [ 'leases' ]
+    verbs: [ "create", "delete" ]