Skip to content
This repository was archived by the owner on Aug 22, 2023. It is now read-only.

Commit 1291519

Browse files
ccremerccremer
committed
Add cluster role for users
1 parent 1a400a7 commit 1291519

File tree

6 files changed

+156
-110
lines changed

6 files changed

+156
-110
lines changed

‎charts/provider-postgresql/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ type: application
1515
# This is the chart version. This version number should be incremented each time you make changes
1616
# to the chart and its templates, including the app version.
1717
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 0.3.1
18+
version: 0.4.0
1919

2020
# This is the version number of the application being deployed. This version number should be
2121
# incremented each time you make changes to the application. Versions are not expected to

‎charts/provider-postgresql/Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ webhook_gen_src = ../../package/webhook/manifests.yaml
22
webhook_gen_tgt = templates/webhook.yaml
33

44
rbac_gen_src = ../../package/rbac/role.yaml
5-
rbac_gen_tgt = templates/clusterrole.yaml
5+
rbac_gen_tgt = templates/operator-clusterrole.yaml
66

77
ifeq ($(shell uname -s),Darwin)
88
sed := gsed -i
@@ -27,7 +27,7 @@ $(webhook_gen_tgt):
2727

2828
$(rbac_gen_tgt):
2929
@cp $(rbac_gen_src) $@
30-
@yq -i e '.metadata.name="{{ include \"provider-postgresql.fullname\" . }}", del(.metadata.creationTimestamp)' $@
30+
@yq -i e '.metadata.name="{{ include \"provider-postgresql.fullname\" . }}-manager", del(.metadata.creationTimestamp)' $@
3131
@yq -i e '.metadata.labels.replace="LABELS"' $@
3232
@$(sed) -e 's/replace: LABELS/{{- include "provider-postgresql.labels" . | nindent 4 }}/g' $@
3333

‎charts/provider-postgresql/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# provider-postgresql
22

3-
![Version: 0.3.1](https://img.shields.io/badge/Version-0.3.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
3+
![Version: 0.4.0](https://img.shields.io/badge/Version-0.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
44

55
VSHN-opinionated PostgreSQL operator for AppCat
66

@@ -11,7 +11,7 @@ helm repo add appcat-service-postgresql https://vshn.github.io/appcat-service-po
1111
helm install provider-postgresql appcat-service-postgresql/provider-postgresql
1212
```
1313
```bash
14-
kubectl apply -f https://github.com/vshn/appcat-service-postgresql/releases/download/provider-postgresql-0.3.1/crds.yaml
14+
kubectl apply -f https://github.com/vshn/appcat-service-postgresql/releases/download/provider-postgresql-0.4.0/crds.yaml
1515
```
1616

1717
<!---

‎charts/provider-postgresql/templates/clusterrole.yaml

Lines changed: 15 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -2,116 +2,36 @@
22
apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRole
44
metadata:
5-
name: '{{ include "provider-postgresql.fullname" . }}'
5+
name: '{{ include "provider-postgresql.fullname" . }}-view'
66
labels:
77
{{- include "provider-postgresql.labels" . | nindent 4 }}
8+
rbac.authorization.k8s.io/aggregate-to-view: "true"
89
rules:
9-
- apiGroups:
10-
- coordination.k8s.io
11-
resources:
12-
- leases
13-
verbs:
14-
- create
15-
- get
16-
- list
17-
- update
18-
- apiGroups:
19-
- ""
20-
resources:
21-
- namespaces
22-
verbs:
23-
- create
24-
- delete
25-
- get
26-
- list
27-
- patch
28-
- update
29-
- watch
30-
- apiGroups:
31-
- ""
32-
resources:
33-
- persistentvolumeclaims
34-
verbs:
35-
- create
36-
- delete
37-
- get
38-
- list
39-
- patch
40-
- update
41-
- watch
42-
- apiGroups:
43-
- ""
44-
resources:
45-
- secrets
46-
verbs:
47-
- create
48-
- delete
49-
- get
50-
- list
51-
- patch
52-
- update
53-
- watch
54-
- apiGroups:
55-
- ""
56-
resources:
57-
- services
58-
verbs:
59-
- get
60-
- list
61-
- watch
62-
- apiGroups:
63-
- helm.crossplane.io
64-
resources:
65-
- providerconfigs
66-
verbs:
67-
- get
68-
- list
69-
- watch
70-
- apiGroups:
71-
- helm.crossplane.io
72-
resources:
73-
- releases
74-
verbs:
75-
- create
76-
- delete
77-
- get
78-
- list
79-
- patch
80-
- update
81-
- watch
82-
- apiGroups:
83-
- k8up.io
84-
resources:
85-
- schedules
86-
verbs:
87-
- create
88-
- delete
89-
- get
90-
- list
91-
- patch
92-
- update
93-
- watch
9410
- apiGroups:
9511
- postgresql.appcat.vshn.io
9612
resources:
97-
- postgresqlstandaloneoperatorconfigs
13+
- postgresqlstandalones
9814
verbs:
99-
- create
100-
- delete
10115
- get
10216
- list
103-
- patch
104-
- update
10517
- watch
10618
- apiGroups:
10719
- postgresql.appcat.vshn.io
10820
resources:
109-
- postgresqlstandaloneoperatorconfigs/finalizers
110-
- postgresqlstandaloneoperatorconfigs/status
21+
- postgresqlstandalones/finalizers
22+
- postgresqlstandalones/status
11123
verbs:
11224
- get
113-
- patch
114-
- update
25+
---
26+
apiVersion: rbac.authorization.k8s.io/v1
27+
kind: ClusterRole
28+
metadata:
29+
name: '{{ include "provider-postgresql.fullname" . }}-edit'
30+
labels:
31+
{{- include "provider-postgresql.labels" . | nindent 4 }}
32+
rbac.authorization.k8s.io/aggregate-to-admin: "true"
33+
rbac.authorization.k8s.io/aggregate-to-edit: "true"
34+
rules:
11535
- apiGroups:
11636
- postgresql.appcat.vshn.io
11737
resources:
@@ -124,12 +44,3 @@ rules:
12444
- patch
12545
- update
12646
- watch
127-
- apiGroups:
128-
- postgresql.appcat.vshn.io
129-
resources:
130-
- postgresqlstandalones/finalizers
131-
- postgresqlstandalones/status
132-
verbs:
133-
- get
134-
- patch
135-
- update

‎charts/provider-postgresql/templates/clusterrolebinding.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ metadata:
88
roleRef:
99
apiGroup: rbac.authorization.k8s.io
1010
kind: ClusterRole
11-
name: {{ include "provider-postgresql.fullname" . }}
11+
name: {{ include "provider-postgresql.fullname" . }}-manager
1212
subjects:
1313
- kind: ServiceAccount
1414
name: {{ include "provider-postgresql.serviceAccountName" . }}

‎charts/provider-postgresql/templates/operator-clusterrole.yaml

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: '{{ include "provider-postgresql.fullname" . }}-manager'
6+
labels:
7+
{{- include "provider-postgresql.labels" . | nindent 4 }}
8+
rules:
9+
- apiGroups:
10+
- coordination.k8s.io
11+
resources:
12+
- leases
13+
verbs:
14+
- create
15+
- get
16+
- list
17+
- update
18+
- apiGroups:
19+
- ""
20+
resources:
21+
- namespaces
22+
verbs:
23+
- create
24+
- delete
25+
- get
26+
- list
27+
- patch
28+
- update
29+
- watch
30+
- apiGroups:
31+
- ""
32+
resources:
33+
- persistentvolumeclaims
34+
verbs:
35+
- create
36+
- delete
37+
- get
38+
- list
39+
- patch
40+
- update
41+
- watch
42+
- apiGroups:
43+
- ""
44+
resources:
45+
- secrets
46+
verbs:
47+
- create
48+
- delete
49+
- get
50+
- list
51+
- patch
52+
- update
53+
- watch
54+
- apiGroups:
55+
- ""
56+
resources:
57+
- services
58+
verbs:
59+
- get
60+
- list
61+
- watch
62+
- apiGroups:
63+
- helm.crossplane.io
64+
resources:
65+
- providerconfigs
66+
verbs:
67+
- get
68+
- list
69+
- watch
70+
- apiGroups:
71+
- helm.crossplane.io
72+
resources:
73+
- releases
74+
verbs:
75+
- create
76+
- delete
77+
- get
78+
- list
79+
- patch
80+
- update
81+
- watch
82+
- apiGroups:
83+
- k8up.io
84+
resources:
85+
- schedules
86+
verbs:
87+
- create
88+
- delete
89+
- get
90+
- list
91+
- patch
92+
- update
93+
- watch
94+
- apiGroups:
95+
- postgresql.appcat.vshn.io
96+
resources:
97+
- postgresqlstandaloneoperatorconfigs
98+
verbs:
99+
- create
100+
- delete
101+
- get
102+
- list
103+
- patch
104+
- update
105+
- watch
106+
- apiGroups:
107+
- postgresql.appcat.vshn.io
108+
resources:
109+
- postgresqlstandaloneoperatorconfigs/finalizers
110+
- postgresqlstandaloneoperatorconfigs/status
111+
verbs:
112+
- get
113+
- patch
114+
- update
115+
- apiGroups:
116+
- postgresql.appcat.vshn.io
117+
resources:
118+
- postgresqlstandalones
119+
verbs:
120+
- create
121+
- delete
122+
- get
123+
- list
124+
- patch
125+
- update
126+
- watch
127+
- apiGroups:
128+
- postgresql.appcat.vshn.io
129+
resources:
130+
- postgresqlstandalones/finalizers
131+
- postgresqlstandalones/status
132+
verbs:
133+
- get
134+
- patch
135+
- update

0 commit comments

Comments
 (0)