Skip to content

Commit e89ea75

Browse files
authored
docs: Update permissions docs (#350)
Signed-off-by: odubajDT <[email protected]>
1 parent 250b5ab commit e89ea75

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

docs/permissions.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ The `manager-role` applies the rules described below, its definition can be foun
3030
| `core.openfeature.dev` | `FeatureFlagConfiguration` | create, delete, get, list, patch, update, watch |
3131
| `core.openfeature.dev` | `FeatureFlagConfiguration Finalizers` | update |
3232
| `core.openfeature.dev` | `FeatureFlagConfiguration Status` | get, patch, update |
33-
| `rbac.authorization.k8s.io` | `*` | * |
33+
| `rbac.authorization.k8s.io` | `ClusterRoleBinding` | get, list, update, watch |
3434

3535
### Proxy Role
3636

@@ -49,7 +49,8 @@ During startup the operator will backfill permissions to the `flagd-kubernetes-s
4949

5050
| API Group | Resource | Verbs |
5151
| ----------- | ----------- | ----------- |
52-
| `core.openfeature.dev` | `*` | get, watch, list |
52+
| `core.openfeature.dev` | `FlagSourceConfiguration` | get, watch, list |
53+
| `core.openfeature.dev` | `FeatureFlagConfiguration` | get, watch, list |
5354

5455
When a `Pod` has the `core.openfeature.dev/enabled` annotation value set to `"true"`, its `Service Account` is added as a subject for this role's `Role Binding`, granting it all required permissions for watching its associated `FeatureFlagConfigurations`. As a result `flagd` can provide real time events describing flag configuration changes.
5556

0 commit comments

Comments
 (0)