Add RBAC

Courtesy of @jhorwit2

Author: prydie

manifests/oci-cloud-controller-manager-rbac.yaml

@@ -1,54 +1,76 @@
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: Role
+kind: ClusterRole
 metadata:
-  name: system::leader-locking-cloud-controller-manager
-  namespace: kube-system
+  name: system:cloud-controller-manager
+  labels:
+    kubernetes.io/cluster-service: "true"
 rules:
 - apiGroups:
   - ""
   resources:
-  - configmaps
-  - endpoints
+  - nodes
   verbs:
-  - create
+  - '*'
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - list
   - watch
+  - patch
+
+- apiGroups:
+  - ""
+  resources:
+  - services/status
+  verbs:
+  - update
+
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - update
+
+# For leader election
 - apiGroups:
   - ""
-  resourceNames:
-  - cloud-controller-manager
   resources:
-  - configmaps
   - endpoints
   verbs:
+  - create
   - get
+  - list
+  - watch
   - update
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: RoleBinding
-metadata:
-  name: system::leader-locking-cloud-controller-manager
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: system::leader-locking-cloud-controller-manager
-subjects:
-- kind: ServiceAccount
-  name: cloud-controller-manager
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: oci-cloud-controller-manager
-rules:
 - apiGroups:
   - ""
   resources:
-  - "*"
+  - serviceaccounts
   verbs:
-  - "*"
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+
+# For the PVL
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumes
+  verbs:
+  - list
+  - watch
+  - patch
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
@@ -57,7 +79,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: oci-cloud-controller-manager
+  name: system:cloud-controller-manager
 subjects:
 - kind: ServiceAccount
   name: cloud-controller-manager