Merge pull request #334 from iamniting/permissions

controllers: remove * and update correct permission
red-hat-storage · Aug 8, 2023 · dd3b851 · dd3b851
2 parents 1ea6cdd + 8e1be54
commit dd3b851
Show file tree

Hide file tree

Showing 4 changed files with 19 additions and 7 deletions.
diff --git a/bundle/manifests/odf-operator.clusterserviceversion.yaml b/bundle/manifests/odf-operator.clusterserviceversion.yaml
@@ -35,7 +35,7 @@ metadata:
     categories: Storage
     console.openshift.io/plugins: '["odf-console"]'
     containerImage: quay.io/ocs-dev/odf-operator:latest
-    createdAt: "2023-07-05T11:25:37Z"
+    createdAt: "2023-08-08T09:50:10Z"
     description: OpenShift Data Foundation provides a common control plane for storage
       solutions on OpenShift Container Platform.
     olm.properties: '[{"type": "olm.maxOpenShiftVersion", "value": "4.15"}]'
@@ -216,13 +216,19 @@ spec:
           resources:
           - consoleplugins
           verbs:
-          - '*'
+          - create
+          - get
+          - update
         - apiGroups:
           - console.openshift.io
           resources:
           - consolequickstarts
           verbs:
-          - '*'
+          - create
+          - delete
+          - get
+          - list
+          - update
         - apiGroups:
           - ocs.openshift.io
           resources:

diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -76,13 +76,19 @@ rules:
   resources:
   - consoleplugins
   verbs:
-  - '*'
+  - create
+  - get
+  - update
 - apiGroups:
   - console.openshift.io
   resources:
   - consolequickstarts
   verbs:
-  - '*'
+  - create
+  - delete
+  - get
+  - list
+  - update
 - apiGroups:
   - ocs.openshift.io
   resources:

diff --git a/controllers/clusterversion_controller.go b/controllers/clusterversion_controller.go
@@ -47,7 +47,7 @@ type ClusterVersionReconciler struct {
 //+kubebuilder:rbac:groups="apps",resources=deployments,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="apps",resources=deployments/finalizers,verbs=update
 //+kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=console.openshift.io,resources=consoleplugins,verbs=*
+//+kubebuilder:rbac:groups=console.openshift.io,resources=consoleplugins,verbs=get;create;update
 
 // For more details, check Reconcile and its Result here:
 // - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/reconcile

diff --git a/controllers/storagesystem_controller.go b/controllers/storagesystem_controller.go
@@ -60,7 +60,7 @@ type StorageSystemReconciler struct {
 //+kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=operators.coreos.com,resources=subscriptions,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=operators.coreos.com,resources=subscriptions/finalizers,verbs=update
-//+kubebuilder:rbac:groups=console.openshift.io,resources=consolequickstarts,verbs=*
+//+kubebuilder:rbac:groups=console.openshift.io,resources=consolequickstarts,verbs=get;list;create;update;delete
 //+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch;create;update
 
 // For more details, check Reconcile and its Result here: