Skip to content

Commit 7cf04bc

Browse files
awgreeneawgreene
committed
Constrain RBACs requested by OLM
Signed-off-by: Alexander Greene <[email protected]>
1 parent 7e8d77c commit 7cf04bc

File tree

1 file changed

+134
-3
lines changed

1 file changed

+134
-3
lines changed

‎deploy/chart/templates/0000_50_olm_01-olm-operator.serviceaccount.yaml

Lines changed: 134 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,142 @@ kind: ClusterRole
33
metadata:
44
name: system:controller:operator-lifecycle-manager
55
rules:
6-
- apiGroups: ["*"]
7-
resources: ["*"]
8-
verbs: ["*"]
96
- nonResourceURLs: ["*"]
107
verbs: ["*"]
8+
# For CRD Validation
9+
- apiGroups:
10+
- "*"
11+
resources:
12+
- "*"
13+
verbs:
14+
- "list"
15+
- apiGroups:
16+
- ""
17+
resources:
18+
- namespaces
19+
- pods
20+
- services
21+
- pods/status
22+
- configmaps
23+
- secrets
24+
- serviceaccounts
25+
- events
26+
verbs:
27+
- "*"
28+
- apiGroups:
29+
- authorization.k8s.io
30+
resources:
31+
- subjectaccessreviews
32+
verbs:
33+
- "*"
34+
- apiGroups:
35+
- autoscaling.k8s.io
36+
resources:
37+
- verticalpodautoscalers
38+
verbs:
39+
- "*"
40+
- apiGroups:
41+
- console.openshift.io
42+
resources:
43+
- consoleyamlsamples
44+
- consolequickstarts
45+
- consoleclidownloads
46+
- consolelinks
47+
verbs:
48+
- "*"
49+
- apiGroups:
50+
- admissionregistration.k8s.io
51+
resources:
52+
- mutatingwebhookconfigurations
53+
- validatingwebhookconfigurations
54+
verbs:
55+
- "*"
56+
- apiGroups:
57+
- apiextensions.k8s.io
58+
resources:
59+
- customresourcedefinitions
60+
verbs:
61+
- "*"
62+
- apiGroups:
63+
- apiregistration.k8s.io
64+
resources:
65+
- apiservices
66+
verbs:
67+
- "*"
68+
- apiGroups:
69+
- apps
70+
resources:
71+
- deployments
72+
verbs:
73+
- "*"
74+
- apiGroups:
75+
- batch
76+
resources:
77+
- jobs
78+
verbs:
79+
- "*"
80+
- apiGroups:
81+
- config.openshift.io
82+
resources:
83+
- clusteroperators
84+
- infrastructures
85+
- proxies
86+
verbs:
87+
- "*"
88+
- apiGroups:
89+
- coordination.k8s.io
90+
resourceNames:
91+
- packageserver-controller-lock
92+
resources:
93+
- leases
94+
verbs:
95+
- "*"
96+
- apiGroups:
97+
- cluster.com
98+
resources:
99+
- "*"
100+
verbs:
101+
- "*"
102+
- apiGroups:
103+
- operators.coreos.com
104+
resources:
105+
- "*"
106+
verbs:
107+
- "*"
108+
- apiGroups:
109+
- packages.operators.coreos.com
110+
resources:
111+
- "*"
112+
verbs:
113+
- "*"
114+
- apiGroups:
115+
- monitoring.coreos.com"
116+
resources:
117+
- prometheusrules
118+
- servicemonitors
119+
verbs:
120+
- "*"
121+
- apiGroups:
122+
- policy
123+
resources:
124+
- poddisruptionbudgets
125+
verbs:
126+
- "*"
127+
- apiGroups:
128+
- scheduling.k8s.io
129+
resources:
130+
- priorityclasses
131+
verbs:
132+
- "*"
133+
- apiGroups:
134+
- rbac.authorization.k8s.io
135+
resources:
136+
- clusterrolebindings
137+
- clusterroles
138+
- rolebindings
139+
- roles
140+
verbs:
141+
- "*"
11142
---
12143
kind: ServiceAccount
13144
apiVersion: v1

0 commit comments

Comments
 (0)