Tighten RBAC permissions (kubernetes-sigs#1526)

* tighten rbac permissions

* remove patch/update for pods

Author: kishorj

config/rbac/leader_election_role.yaml

@@ -9,24 +9,7 @@ rules:
     resources:
       - configmaps
     verbs:
-      - get
-      - list
-      - watch
       - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps/status
-    verbs:
       - get
       - update
       - patch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create

config/rbac/role.yaml

@@ -20,12 +20,6 @@ rules:
   - events
   verbs:
   - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - ""
   resources:
@@ -49,15 +43,12 @@ rules:
   verbs:
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - ""
   resources:
   - pods/status
   verbs:
-  - get
   - patch
   - update
 - apiGroups:
@@ -83,7 +74,6 @@ rules:
   resources:
   - services/status
   verbs:
-  - get
   - patch
   - update
 - apiGroups:
@@ -103,7 +93,6 @@ rules:
   resources:
   - targetgroupbindings/status
   verbs:
-  - get
   - patch
   - update
 - apiGroups:
@@ -121,7 +110,6 @@ rules:
   resources:
   - ingresses/status
   verbs:
-  - get
   - patch
   - update
 - apiGroups:
@@ -139,6 +127,5 @@ rules:
   resources:
   - ingresses/status
   verbs:
-  - get
   - patch
   - update

controllers/elbv2/targetgroupbinding_controller.go

@@ -67,14 +67,14 @@ type targetGroupBindingReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=elbv2.k8s.aws,resources=targetgroupbindings,verbs=get;list;watch;update;patch;create;delete
-// +kubebuilder:rbac:groups=elbv2.k8s.aws,resources=targetgroupbindings/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;update;patch
-// +kubebuilder:rbac:groups="",resources=pods/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=elbv2.k8s.aws,resources=targetgroupbindings/status,verbs=update;patch
+// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=pods/status,verbs=update;patch
 // +kubebuilder:rbac:groups="",resources=nodes,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=endpoints,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;update;patch;create;delete
+// +kubebuilder:rbac:groups="",resources=events,verbs=create
 
 func (r *targetGroupBindingReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
 	return runtime.HandleReconcileError(r.reconcile(req), r.logger)

controllers/ingress/group_controller.go

@@ -87,12 +87,12 @@ type groupReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;list;watch;update;patch
-// +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses/status,verbs=update;patch
 // +kubebuilder:rbac:groups=extensions,resources=ingresses,verbs=get;list;watch;update;patch
-// +kubebuilder:rbac:groups=extensions,resources=ingresses/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=extensions,resources=ingresses/status,verbs=update;patch
 // +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;update;patch;create;delete
+// +kubebuilder:rbac:groups="",resources=events,verbs=create
 
 // Reconcile
 func (r *groupReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {

controllers/service/service_controller.go

@@ -69,8 +69,8 @@ type serviceReconciler struct {
 }
 
 // +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;update;patch
-// +kubebuilder:rbac:groups="",resources=services/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;update;patch;create;delete
+// +kubebuilder:rbac:groups="",resources=services/status,verbs=update;patch
+// +kubebuilder:rbac:groups="",resources=events,verbs=create
 
 func (r *serviceReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
 	return runtime.HandleReconcileError(r.reconcile(req), r.logger)