Update permission on operator level

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
opendatahub-io · Aug 15, 2023 · cf8ebdd · cf8ebdd
1 parent acaaf31
commit cf8ebdd
Show file tree

Hide file tree

Showing 5 changed files with 585 additions and 70 deletions.
diff --git a/bundle/manifests/opendatahub-operator.clusterserviceversion.yaml b/bundle/manifests/opendatahub-operator.clusterserviceversion.yaml
@@ -247,55 +247,161 @@ spec:
       clusterPermissions:
       - rules:
         - apiGroups:
-          - '*'
+          - addons.managed.openshift.io
           resources:
-          - '*'
+          - addons
           verbs:
-          - '*'
+          - get
         - apiGroups:
-          - addons.managed.openshift.io
+          - admissionregistration.k8s.io/v1
           resources:
-          - addons
+          - mutatingwebhookconfigurations
+          verbs:
+          - create
+          - get
+        - apiGroups:
+          - admissionregistration.k8s.io/v1
+          resources:
+          - validatingwebhookconfigurations
           verbs:
+          - create
           - get
-          - list
         - apiGroups:
-          - apps
+          - apiextensions.k8s.io
+          resources:
+          - customresourcedefinitions
+          verbs:
+          - create
+          - get
+        - apiGroups:
+          - batch/v1
+          resources:
+          - cronjobs
+          verbs:
+          - create
+          - get
+          - patch
+        - apiGroups:
+          - cert-manager.io/v1
+          resources:
+          - certificates
+          - issuers
+          verbs:
+          - create
+        - apiGroups:
+          - codeflare.codeflare.dev/v1alpha1
+          resources:
+          - instascales
+          verbs:
+          - create
+        - apiGroups:
+          - codeflare.codeflare.dev/v1alpha1
+          resources:
+          - mcads
+          verbs:
+          - create
+        - apiGroups:
+          - console.openshift.io/v1
+          resources:
+          - consolelinks
+          verbs:
+          - create
+          - get
+          - patch
+        - apiGroups:
+          - console.openshift.io/v1
+          resources:
+          - odhquickstarts
+          verbs:
+          - create
+          - get
+          - patch
+        - apiGroups:
+          - controller-runtime.sigs.k8s.io
           resources:
-          - daemonsets
-          - deployments
-          - replicasets
-          - statefulsets
+          - controllermanagerconfigs
           verbs:
-          - '*'
+          - create
+          - get
         - apiGroups:
           - ""
           resources:
           - configmaps
-          - endpoints
+          verbs:
+          - create
+          - get
+          - watch
+        - apiGroups:
+          - ""
+          resources:
+          - developments
+          verbs:
+          - create
+          - get
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - ""
+          resources:
           - events
-          - persistentvolumeclaims
-          - pods
-          - secrets
-          - services
-          - services/finalizers
           verbs:
-          - '*'
+          - create
+          - get
+          - update
+          - watch
         - apiGroups:
           - ""
           resources:
-          - configmaps
           - namespaces
+          verbs:
+          - create
+          - delete
+          - get
+          - patch
+        - apiGroups:
+          - ""
+          resources:
           - secrets
+          verbs:
+          - create
+          - get
+          - watch
+        - apiGroups:
+          - ""
+          resources:
           - serviceaccounts
-          - services
           verbs:
           - create
           - get
           - list
           - patch
           - update
           - watch
+        - apiGroups:
+          - ""
+          resources:
+          - services
+          verbs:
+          - create
+          - get
+          - update
+        - apiGroups:
+          - dashboard.opendatahub.io/v1
+          resources:
+          - odhapplications
+          verbs:
+          - create
+          - get
+          - patch
+        - apiGroups:
+          - dashboard.opendatahub.io/v1
+          resources:
+          - odhdocuments
+          verbs:
+          - create
+          - get
+          - patch
         - apiGroups:
           - datasciencecluster.opendatahub.io
           resources:
@@ -339,6 +445,7 @@ spec:
           resources:
           - dscinitializations/finalizers
           verbs:
+          - get
           - update
         - apiGroups:
           - dscinitialization.opendatahub.io
@@ -349,16 +456,78 @@ spec:
           - patch
           - update
         - apiGroups:
-          - networking.k8s.io
+          - image.openshift.io/v1
+          resources:
+          - imagestreams
+          verbs:
+          - create
+          - update
+        - apiGroups:
+          - monitoring.coreos.com
+          resources:
+          - prometheuses
+          verbs:
+          - create
+          - get
+        - apiGroups:
+          - monitoring.coreos.com
+          resources:
+          - prometheusrules
+          verbs:
+          - create
+          - get
+        - apiGroups:
+          - monitoring.coreos.com
+          resources:
+          - servicemonitors
+          verbs:
+          - create
+          - get
+        - apiGroups:
+          - networking.k8s.io/v1
           resources:
           - networkpolicies
           verbs:
           - create
           - get
-          - list
+        - apiGroups:
+          - oauth.openshift.io
+          resources:
+          - oauthclients
+          verbs:
+          - create
+          - delete
+          - get
+        - apiGroups:
+          - opendatahub.io/v1alpha
+          resources:
+          - odhdashboardconfig
+          verbs:
+          - create
+          - get
           - patch
+        - apiGroups:
+          - operators.coreos.com/v1alpha1
+          resources:
+          - clusterserviceversions
+          verbs:
+          - get
+          - list
+        - apiGroups:
+          - operators.coreos.com/v1alpha1
+          resources:
+          - subscriptions
+          verbs:
+          - get
+        - apiGroups:
+          - rayjobs.ray.io
+          resources:
+          - rayclusters
+          - rayjobs
+          - rayservices
+          verbs:
+          - create
           - update
-          - watch
         - apiGroups:
           - rbac.authorization.k8s.io
           resources:
@@ -369,10 +538,45 @@ spec:
           verbs:
           - create
           - get
-          - list
+          - update
+        - apiGroups:
+          - route.openshift.io
+          resources:
+          - routes
+          verbs:
+          - create
+          - get
+        - apiGroups:
+          - security.openshift.io/v1
+          resources:
+          - securitycontextconstraints
+          verbs:
+          - create
           - patch
           - update
-          - watch
+        - apiGroups:
+          - serving.kserve.io/v1alpha1
+          resources:
+          - clusterservingruntimes
+          verbs:
+          - create
+          - get
+          - patch
+        - apiGroups:
+          - template.openshift.io/v1
+          resources:
+          - templates
+          verbs:
+          - create
+          - get
+          - patch
+        - apiGroups:
+          - user.openshift.io
+          resources:
+          - groups
+          verbs:
+          - create
+          - get
         - apiGroups:
           - authentication.k8s.io
           resources: