Constrain RBACs requested by OLM

deploy/chart/templates/0000_50_olm_01-olm-operator.serviceaccount.yaml

@@ -3,11 +3,142 @@ kind: ClusterRole
 metadata:
   name: system:controller:operator-lifecycle-manager
 rules:
-- apiGroups: ["*"]
-  resources: ["*"]
-  verbs: ["*"]
 - nonResourceURLs: ["*"]
   verbs: ["*"]
+  # For CRD Validation
+- apiGroups:
+  - "*"
+  resources:
+  - "*"
+  verbs:
+  - "list"
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  - pods
+  - services
+  - pods/status
+  - configmaps
+  - secrets
+  - serviceaccounts
+  - events
+  verbs:
+  - "*"
+- apiGroups: 
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - "*"
+- apiGroups:
+  - autoscaling.k8s.io
+  resources:
+  - verticalpodautoscalers
+  verbs:
+  - "*"
+- apiGroups:
+  - console.openshift.io
+  resources:
+  - consoleyamlsamples
+  - consolequickstarts
+  - consoleclidownloads
+  - consolelinks
+  verbs:
+  - "*"
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
+  verbs:
+  - "*"
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - "*"
+- apiGroups:
+  - apiregistration.k8s.io
+  resources:
+  - apiservices
+  verbs:
+  - "*"
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - "*"
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - "*"
+- apiGroups:
+  - config.openshift.io
+  resources:
+  - clusteroperators
+  - infrastructures
+  - proxies
+  verbs:
+  - "*"
+- apiGroups:
+  - coordination.k8s.io
+  resourceNames:
+  - packageserver-controller-lock
+  resources:
+  - leases
+  verbs:
+  - "*"
+- apiGroups:
+  - cluster.com
+  resources:
+  - "*"
+  verbs:
+  - "*"
+- apiGroups:
+  - operators.coreos.com
+  resources:
+  - "*"
+  verbs:
+  - "*"
+- apiGroups:
+  - packages.operators.coreos.com
+  resources:
+  - "*"
+  verbs:
+  - "*"
+- apiGroups: 
+  - monitoring.coreos.com"
+  resources:
+  - prometheusrules
+  - servicemonitors
+  verbs:
+  - "*"
+- apiGroups:
+  - policy
+  resources:
+  - poddisruptionbudgets
+  verbs:
+  - "*"
+- apiGroups:
+  - scheduling.k8s.io
+  resources:
+  - priorityclasses
+  verbs:
+  - "*"
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  - clusterroles
+  - rolebindings
+  - roles
+  verbs:
+  - "*"
 ---
 kind: ServiceAccount
 apiVersion: v1