Skip to content

Commit ac44ec3

Browse files
awgreeneawgreene
committed
Constrain RBACs requested by OLM
Signed-off-by: Alexander Greene <[email protected]>
1 parent 7e8d77c commit ac44ec3

File tree

1 file changed

+127
-3
lines changed

1 file changed

+127
-3
lines changed

‎deploy/chart/templates/0000_50_olm_01-olm-operator.serviceaccount.yaml

Lines changed: 127 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,135 @@ kind: ClusterRole
33
metadata:
44
name: system:controller:operator-lifecycle-manager
55
rules:
6-
- apiGroups: ["*"]
7-
resources: ["*"]
8-
verbs: ["*"]
96
- nonResourceURLs: ["*"]
107
verbs: ["*"]
8+
- apiGroups:
9+
- ""
10+
resources:
11+
- namespaces
12+
- pods
13+
- services
14+
- pods/status
15+
- configmaps
16+
- secrets
17+
- serviceaccounts
18+
- events
19+
verbs:
20+
- "*"
21+
- apiGroups:
22+
- authorization.k8s.io
23+
resources:
24+
- subjectaccessreviews
25+
verbs:
26+
- "*"
27+
- apiGroups:
28+
- autoscaling.k8s.io
29+
resources:
30+
- verticalpodautoscalers
31+
verbs:
32+
- "*"
33+
- apiGroups:
34+
- console.openshift.io
35+
resources:
36+
- consoleyamlsamples
37+
- consolequickstarts
38+
- consoleclidownloads
39+
- consolelinks
40+
verbs:
41+
- "*"
42+
- apiGroups:
43+
- admissionregistration.k8s.io
44+
resources:
45+
- mutatingwebhookconfigurations
46+
- validatingwebhookconfigurations
47+
verbs:
48+
- "*"
49+
- apiGroups:
50+
- apiextensions.k8s.io
51+
resources:
52+
- customresourcedefinitions
53+
verbs:
54+
- "*"
55+
- apiGroups:
56+
- apiregistration.k8s.io
57+
resources:
58+
- apiservices
59+
verbs:
60+
- "*"
61+
- apiGroups:
62+
- apps
63+
resources:
64+
- deployments
65+
verbs:
66+
- "*"
67+
- apiGroups:
68+
- batch
69+
resources:
70+
- jobs
71+
verbs:
72+
- "*"
73+
- apiGroups:
74+
- config.openshift.io
75+
resources:
76+
- clusteroperators
77+
- infrastructures
78+
- proxies
79+
verbs:
80+
- "*"
81+
- apiGroups:
82+
- coordination.k8s.io
83+
resourceNames:
84+
- packageserver-controller-lock
85+
resources:
86+
- leases
87+
verbs:
88+
- "*"
89+
- apiGroups:
90+
- cluster.com
91+
resources:
92+
- "*"
93+
verbs:
94+
- "*"
95+
- apiGroups:
96+
- operators.coreos.com
97+
resources:
98+
- "*"
99+
verbs:
100+
- "*"
101+
- apiGroups:
102+
- packages.operators.coreos.com
103+
resources:
104+
- "*"
105+
verbs:
106+
- "*"
107+
- apiGroups:
108+
- monitoring.coreos.com"
109+
resources:
110+
- prometheusrules
111+
- servicemonitors
112+
verbs:
113+
- "*"
114+
- apiGroups:
115+
- policy
116+
resources:
117+
- poddisruptionbudgets
118+
verbs:
119+
- "*"
120+
- apiGroups:
121+
- scheduling.k8s.io
122+
resources:
123+
- priorityclasses
124+
verbs:
125+
- "*"
126+
- apiGroups:
127+
- rbac.authorization.k8s.io
128+
resources:
129+
- clusterrolebindings
130+
- clusterroles
131+
- rolebindings
132+
- roles
133+
verbs:
134+
- "*"
11135
---
12136
kind: ServiceAccount
13137
apiVersion: v1

0 commit comments

Comments
 (0)