From 44dd679a5952569a7ae36395202fdf609130fdef Mon Sep 17 00:00:00 2001
From: timsn <timsn@users.noreply.github.com>
Date: Mon, 10 Feb 2025 17:53:24 +0100
Subject: [PATCH] [FLINK-35937] RBAC cleanup

---
 .../templates/rbac.yaml                       | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/helm/flink-kubernetes-operator/templates/rbac.yaml b/helm/flink-kubernetes-operator/templates/rbac.yaml
index 9ab91d38ec..ecc4c21a2d 100644
--- a/helm/flink-kubernetes-operator/templates/rbac.yaml
+++ b/helm/flink-kubernetes-operator/templates/rbac.yaml
@@ -50,7 +50,6 @@ rules:
       - apps
     resources:
       - deployments
-      - deployments/scale
       - deployments/finalizers
       - replicasets
     verbs:
@@ -61,6 +60,14 @@ rules:
       - update
       - patch
       - delete
+  - apiGroups:
+      - apps
+    resources:
+      - deployments/scale
+    verbs:
+      - get
+      - update
+      - patch
   - apiGroups:
       - extensions
     resources:
@@ -82,7 +89,6 @@ rules:
       - flinksessionjobs
       - flinksessionjobs/finalizers
       - flinkstatesnapshots
-      - flinkstatesnapshots/status
       - flinkstatesnapshots/finalizers
     verbs:
       - get
@@ -97,6 +103,7 @@ rules:
     resources:
       - flinkdeployments/status
       - flinksessionjobs/status
+      - flinkstatesnapshots/status
     verbs:
       - get
       - update
@@ -248,7 +255,13 @@ rules:
     resources:
       - leases
     verbs:
-      - "*"
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
 {{- end }}
 ---
 {{- if and .Values.rbac.operatorRole.create (not (has .Release.Namespace .Values.watchNamespaces)) }}