[FLINK-35937] RBAC cleanup

apache · Feb 10, 2025 · 44dd679 · 44dd679
1 parent b7d6f9d
commit 44dd679
Showing 1 changed file with 16 additions and 3 deletions.
diff --git a/helm/flink-kubernetes-operator/templates/rbac.yaml b/helm/flink-kubernetes-operator/templates/rbac.yaml
@@ -50,7 +50,6 @@ rules:
       - apps
     resources:
       - deployments
-      - deployments/scale
       - deployments/finalizers
       - replicasets
     verbs:
@@ -61,6 +60,14 @@ rules:
       - update
       - patch
       - delete
+  - apiGroups:
+      - apps
+    resources:
+      - deployments/scale
+    verbs:
+      - get
+      - update
+      - patch
   - apiGroups:
       - extensions
     resources:
@@ -82,7 +89,6 @@ rules:
       - flinksessionjobs
       - flinksessionjobs/finalizers
       - flinkstatesnapshots
-      - flinkstatesnapshots/status
       - flinkstatesnapshots/finalizers
     verbs:
       - get
@@ -97,6 +103,7 @@ rules:
     resources:
       - flinkdeployments/status
       - flinksessionjobs/status
+      - flinkstatesnapshots/status
     verbs:
       - get
       - update
@@ -248,7 +255,13 @@ rules:
     resources:
       - leases
     verbs:
-      - "*"
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
 {{- end }}
 ---
 {{- if and .Values.rbac.operatorRole.create (not (has .Release.Namespace .Values.watchNamespaces)) }}