fix: rbac (#86)

* fixing rbac

Signed-off-by: Alex Jones <[email protected]>

* fixing rbac

Signed-off-by: Alex Jones <[email protected]>

* fixing rbac

Signed-off-by: Alex Jones <[email protected]>

* Update kustomization.yaml

Signed-off-by: Alex Jones <[email protected]>

* Update manager.yaml

Signed-off-by: Alex Jones <[email protected]>

* Update flagd_kubernetes_sync_clusterrole.yaml

Signed-off-by: Alex Jones <[email protected]>

Signed-off-by: Alex Jones <[email protected]>

Author: AlexsJones

config/rbac/flagd_kubernetes_sync_clusterrole.yaml

@@ -4,6 +4,6 @@ metadata:
 # Prepends to open-feature-operator-flagd-kubernetes-sync
   name: flagd-kubernetes-sync
 rules:
-- apiGroups: ["core.openfeature.dev"]
+- apiGroups: ["core.openfeature.dev"] 
   resources: ["*"]
   verbs: ["get", "watch", "list"]

config/rbac/flagd_kubernetes_sync_clusterrolebinding.yaml

@@ -1,4 +1,3 @@
-#This adds the default account to the cluster role but will also have deployments added
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

config/rbac/role.yaml

@@ -29,6 +29,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - core.openfeature.dev
   resources:
@@ -55,3 +63,9 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - '*'
+  verbs:
+  - '*'

webhooks/pod_webhook.go

@@ -31,6 +31,8 @@ var FlagDTag = "main"
 //+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:webhook:path=/mutate-v1-pod,mutating=true,failurePolicy=Ignore,groups="",resources=pods,verbs=create;update,versions=v1,name=mutate.openfeature.dev,admissionReviewVersions=v1,sideEffects=NoneOnDryRun
+//+kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;
+//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=*,verbs=*;
 
 // PodMutator annotates Pods
 type PodMutator struct {