Shipa 1823 (#125)

* adds rbac perms to get lease & jobs * adds job permissions for batch group
theketchio · Aug 27, 2021 · 7961e75 · 7961e75
1 parent 022d37a
commit 7961e75
Show file tree

Hide file tree

Showing 3 changed files with 48 additions and 3 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -87,6 +87,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - cert-manager.io
   resources:
@@ -99,6 +111,15 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - list
+  - update
 - apiGroups:
   - extensions
   resources:
@@ -237,6 +258,26 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - theketch.io
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - theketch.io
+  resources:
+  - jobs/status
+  verbs:
+  - get
+  - patch
+  - update
 - apiGroups:
   - traefik.containo.us
   resources:

diff --git a/internal/controllers/app_controller.go b/internal/controllers/app_controller.go
@@ -86,6 +86,7 @@ type Helm interface {
 // +kubebuilder:rbac:groups="traefik.containo.us",resources=traefikservices,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups="traefik.containo.us",resources=traefikservices/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch;update;delete
+// +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;create;update
 
 func (r *AppReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	_ = r.Log.WithValues("app", req.NamespacedName)

diff --git a/internal/controllers/job_controller.go b/internal/controllers/job_controller.go
@@ -53,9 +53,12 @@ type JobReconcileReason struct {
 	JobName string
 }
 
-//+kubebuilder:rbac:groups=resources.resources,resources=jobs,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=resources.resources,resources=jobs/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups=resources.resources,resources=jobs/finalizers,verbs=update
+// +kubebuilder:rbac:groups=resources.resources,resources=jobs,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=resources.resources,resources=jobs/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=resources.resources,resources=jobs/finalizers,verbs=update
+// +kubebuilder:rbac:groups=theketch.io,resources=jobs,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=theketch.io,resources=jobs/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete
 
 // Reconcile fetches a Job by name and updates helm charts with differences
 func (r *JobReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {