fix: update rbac (#28)

* fix: update rbac

* fix: remove hardcoded ns

Author: alexouzounis

prow/templates/crier-rbac.yaml

@@ -6,6 +6,7 @@ metadata:
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
+  # "namespace" omitted since ClusterRoles are not namespaced
   name: crier
 rules:
 - apiGroups:

prow/templates/deck-rbac.yaml

@@ -15,6 +15,9 @@ rules:
     verbs:
       - get
       - list
+      - watch
+      # Required when deck runs with `--rerun-creates-job=true`
+      - create
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1

prow/templates/plank-rbac.yaml

@@ -33,7 +33,6 @@ rules:
       - create
       - delete
       - list
-      - patch
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1

prow/templates/sinker-rbac.yaml

@@ -15,6 +15,24 @@ rules:
     verbs:
       - delete
       - list
+      - watch
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    resourceNames:
+      - prow-sinker-leaderlock
+    verbs:
+      - get
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - events
+    verbs:
+      - create
 ---
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1beta1