Skip to content

Commit 1cbc49c

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #3907 from Ankitasw/scope-down-rbac
Scope down RBAC permissions for CAPA resources
2 parents cb077a4 + ef098c4 commit 1cbc49c

File tree

10 files changed

+10
-20
lines changed

10 files changed

+10
-20
lines changed

‎bootstrap/eks/controllers/eksconfig_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ type EKSConfigReconciler struct {
5656
WatchFilterValue string
5757
}
5858

59-
// +kubebuilder:rbac:groups=bootstrap.cluster.x-k8s.io,resources=eksconfigs,verbs=get;list;watch;create;update;patch;delete
59+
// +kubebuilder:rbac:groups=bootstrap.cluster.x-k8s.io,resources=eksconfigs,verbs=get;list;watch;update;patch
6060
// +kubebuilder:rbac:groups=bootstrap.cluster.x-k8s.io,resources=eksconfigs/status,verbs=get;update;patch
6161
// +kubebuilder:rbac:groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes,verbs=get;list;watch
6262
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines;machinepools;clusters,verbs=get;list;watch

‎config/rbac/role.yaml

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,6 @@ rules:
4141
resources:
4242
- eksconfigs
4343
verbs:
44-
- create
45-
- delete
4644
- get
4745
- list
4846
- patch
@@ -107,7 +105,6 @@ rules:
107105
resources:
108106
- awsmanagedcontrolplanes
109107
verbs:
110-
- create
111108
- delete
112109
- get
113110
- list
@@ -146,7 +143,6 @@ rules:
146143
resources:
147144
- awsclustercontrolleridentities
148145
verbs:
149-
- create
150146
- get
151147
- list
152148
- watch
@@ -174,7 +170,6 @@ rules:
174170
resources:
175171
- awsclusters
176172
verbs:
177-
- create
178173
- delete
179174
- get
180175
- list
@@ -194,7 +189,6 @@ rules:
194189
resources:
195190
- awsfargateprofiles
196191
verbs:
197-
- create
198192
- delete
199193
- get
200194
- list
@@ -214,7 +208,6 @@ rules:
214208
resources:
215209
- awsmachinepools
216210
verbs:
217-
- create
218211
- delete
219212
- get
220213
- list
@@ -243,7 +236,6 @@ rules:
243236
resources:
244237
- awsmachines
245238
verbs:
246-
- create
247239
- delete
248240
- get
249241
- list
@@ -272,7 +264,6 @@ rules:
272264
resources:
273265
- awsmanagedclusters
274266
verbs:
275-
- create
276267
- delete
277268
- get
278269
- list
@@ -301,7 +292,6 @@ rules:
301292
resources:
302293
- awsmanagedmachinepools
303294
verbs:
304-
- create
305295
- delete
306296
- get
307297
- list

‎controllers/awscluster_controller.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -123,11 +123,11 @@ func (r *AWSClusterReconciler) getSecurityGroupService(scope scope.ClusterScope)
123123
return securitygroup.NewService(&scope, securityGroupRolesForCluster(scope))
124124
}
125125

126-
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclusters,verbs=get;list;watch;create;update;patch;delete
126+
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclusters,verbs=get;list;watch;update;patch;delete
127127
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclusters/status,verbs=get;update;patch
128128
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters;clusters/status,verbs=get;list;watch
129129
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclusterroleidentities;awsclusterstaticidentities,verbs=get;list;watch
130-
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclustercontrolleridentities,verbs=get;list;watch;create;
130+
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclustercontrolleridentities,verbs=get;list;watch
131131

132132
func (r *AWSClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request) (_ ctrl.Result, reterr error) {
133133
log := logger.FromContext(ctx)

‎controllers/awsmachine_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ func (r *AWSMachineReconciler) getObjectStoreService(scope scope.S3Scope) servic
133133
return s3.NewService(scope)
134134
}
135135

136-
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmachines,verbs=get;list;watch;create;update;patch;delete
136+
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmachines,verbs=get;list;watch;update;patch;delete
137137
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmachines/status,verbs=get;update;patch
138138
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines;machines/status,verbs=get;list;watch
139139
// +kubebuilder:rbac:groups="",resources=secrets;,verbs=get;list;watch

‎controllers/awsmanagedcluster_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ type AWSManagedClusterReconciler struct {
4949
WatchFilterValue string
5050
}
5151

52-
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmanagedclusters,verbs=get;list;watch;create;update;patch;delete
52+
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmanagedclusters,verbs=get;list;watch;update;patch;delete
5353
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmanagedclusters/status,verbs=get;update;patch
5454
// +kubebuilder:rbac:groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes;awsmanagedcontrolplanes/status,verbs=get;list;watch
5555
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters;clusters/status,verbs=get;list;watch

‎controlplane/eks/controllers/awsmanagedcontrolplane_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ func (r *AWSManagedControlPlaneReconciler) SetupWithManager(ctx context.Context,
133133
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmachines;awsmachines/status,verbs=get;list;watch
134134
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmanagedmachinepools;awsmanagedmachinepools/status,verbs=get;list;watch
135135
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmachinepools;awsmachinepools/status,verbs=get;list;watch
136-
// +kubebuilder:rbac:groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes,verbs=get;list;watch;create;update;patch;delete
136+
// +kubebuilder:rbac:groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes,verbs=get;list;watch;update;patch;delete
137137
// +kubebuilder:rbac:groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes/status,verbs=get;update;patch
138138
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclusterroleidentities;awsclusterstaticidentities;awsclustercontrolleridentities,verbs=get;list;watch
139139
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmanagedclusters;awsmanagedclusters/status,verbs=get;list;watch

‎exp/controlleridentitycreator/awscontrolleridentity_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ type AWSControllerIdentityReconciler struct {
4848
WatchFilterValue string
4949
}
5050

51-
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclustercontrolleridentities,verbs=get;list;watch;create
51+
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsclustercontrolleridentities,verbs=get;list;watch
5252

5353
func (r *AWSControllerIdentityReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
5454
log := logger.FromContext(ctx)

‎exp/controllers/awsfargatepool_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func (r *AWSFargateProfileReconciler) SetupWithManager(ctx context.Context, mgr
6969
// +kubebuilder:rbac:groups=core,resources=events,verbs=get;list;watch;create;patch
7070
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters;clusters/status,verbs=get;list;watch
7171
// +kubebuilder:rbac:groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes;awsmanagedcontrolplanes/status,verbs=get;list;watch
72-
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsfargateprofiles,verbs=get;list;watch;create;update;patch;delete
72+
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsfargateprofiles,verbs=get;list;watch;update;patch;delete
7373
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsfargateprofiles/status,verbs=get;update;patch
7474

7575
// Reconcile reconciles AWSFargateProfiles.

‎exp/controllers/awsmachinepool_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func (r *AWSMachinePoolReconciler) getEC2Service(scope scope.EC2Scope) services.
7777
return ec2.NewService(scope)
7878
}
7979

80-
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmachinepools,verbs=get;list;watch;create;update;patch;delete
80+
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmachinepools,verbs=get;list;watch;update;patch;delete
8181
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmachinepools/status,verbs=get;update;patch
8282
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinepools;machinepools/status,verbs=get;list;watch;patch
8383
// +kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;create;update;patch

‎exp/controllers/awsmanagedmachinepool_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func (r *AWSManagedMachinePoolReconciler) SetupWithManager(ctx context.Context,
8888
// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinepools;machinepools/status,verbs=get;list;watch
8989
// +kubebuilder:rbac:groups=core,resources=events,verbs=get;list;watch;create;patch
9090
// +kubebuilder:rbac:groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes;awsmanagedcontrolplanes/status,verbs=get;list;watch
91-
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmanagedmachinepools,verbs=get;list;watch;create;update;patch;delete
91+
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmanagedmachinepools,verbs=get;list;watch;update;patch;delete
9292
// +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=awsmanagedmachinepools/status,verbs=get;update;patch
9393

9494
// Reconcile reconciles AWSManagedMachinePools.

0 commit comments

Comments
 (0)