Cluster roles for operator and domain admins

Author: rjeberhard

kubernetes/charts/weblogic-operator/templates/_operator-clusterrole-domain-admin.tpl

@@ -0,0 +1,32 @@
+# Copyright 2018 Oracle Corporation and/or its affiliates.  All rights reserved.
+# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
+
+{{- define "operator.operatorClusterRoleDomainAdmin" }}
+---
+kind: "ClusterRole"
+apiVersion: "rbac.authorization.k8s.io/v1"
+metadata:
+  name: {{ list .Release.Namespace "weblogic-operator-clusterrole-domain-admin" | join "-" | quote }}
+  labels:
+    weblogic.resourceVersion: "operator-v2"
+    weblogic.operatorName: {{ .Release.Namespace | quote }}
+rules:
+- apiGroups: [""]
+  resources: ["configmaps", "deployments"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"]
+- apiGroups: [""]
+  resources: ["secrets", "pods", "events"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get", "list"]
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["create"]
+- apiGroups: ["weblogic.oracle"]
+  resources: ["domains"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"]
+- apiGroups: ["weblogic.oracle"]
+  resources: ["domains/status"]
+  verbs: ["get", "watch"]
+{{- end }}

kubernetes/charts/weblogic-operator/templates/_operator-clusterrole-operator-admin.tpl

@@ -0,0 +1,26 @@
+# Copyright 2018 Oracle Corporation and/or its affiliates.  All rights reserved.
+# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
+
+{{- define "operator.operatorClusterRoleOperatorAdmin" }}
+---
+kind: "ClusterRole"
+apiVersion: "rbac.authorization.k8s.io/v1"
+metadata:
+  name: {{ list .Release.Namespace "weblogic-operator-clusterrole-operator-admin" | join "-" | quote }}
+  labels:
+    weblogic.resourceVersion: "operator-v2"
+    weblogic.operatorName: {{ .Release.Namespace | quote }}
+rules:
+- apiGroups: [""]
+  resources: ["configmaps", "secrets"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"]
+- apiGroups: [""]
+  resources: ["pods", "events"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get", "list"]
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["create"]
+{{- end }}

kubernetes/charts/weblogic-operator/templates/_operator.tpl

@@ -5,6 +5,8 @@
 {{- include "operator.operatorClusterRoleGeneral" . }}
 {{- include "operator.operatorClusterRoleNamespace" . }}
 {{- include "operator.operatorClusterRoleNonResource" . }}
+{{- include "operator.operatorClusterRoleOperatorAdmin" . }}
+{{- include "operator.operatorClusterRoleDomainAdmin" . }}
 {{- include "operator.clusterRoleBindingGeneral" . }}
 {{- include "operator.clusterRoleBindingAuthDelegator" . }}
 {{- include "operator.clusterRoleBindingDiscovery" . }}