Refactor rbac

k0rdent · Nov 13, 2024 · c689cd1 · c689cd1
1 parent c88f05d
commit c689cd1
Showing 1 changed file with 48 additions and 4 deletions.
diff --git a/templates/provider/hmc/templates/rbac/controller/roles.yaml b/templates/provider/hmc/templates/rbac/controller/roles.yaml
@@ -206,18 +206,50 @@ rules:
   - patch
   - update
 - apiGroups:
-  - ""
+    - ""
   resources:
-  - secrets
-  verbs: {{ include "rbac.editorVerbs" . | nindent 4 }}
+    - secrets
+  verbs:
+    - get
+    - list
 - apiGroups:
     - hmc.mirantis.com
   resources:
     - unmanagedclusters
+  verbs: {{ include "rbac.editorVerbs" . | nindent 4 }}
+- apiGroups:
+    - hmc.mirantis.com
+  resources:
+    - unmanagedclusters/finalizers
+  verbs:
+    - update
+- apiGroups:
+    - hmc.mirantis.com
+  resources:
     - unmanagedclusters/status
+  verbs:
+    - get
+    - patch
+    - update
+- apiGroups:
+    - hmc.mirantis.com
+  resources:
     - unmanagedmachines
-    - unmanagedmachines/status
   verbs: {{ include "rbac.editorVerbs" . | nindent 4 }}
+- apiGroups:
+    - hmc.mirantis.com
+  resources:
+    - unmanagedmachines/finalizers
+  verbs:
+    - update
+- apiGroups:
+    - hmc.mirantis.com
+  resources:
+    - unmanagedmachines/status
+  verbs:
+    - get
+    - patch
+    - update
 - apiGroups:
     - cluster.x-k8s.io
   resources:
@@ -259,7 +291,19 @@ rules:
       - hmc.mirantis.com
     resources:
       - unmanagedclusters
+    verbs: {{ include "rbac.viewerVerbs" . | nindent 4 }}
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
       - unmanagedclusters/status
+    verbs: {{ include "rbac.viewerVerbs" . | nindent 4 }}
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
       - unmanagedmachines
+    verbs: {{ include "rbac.viewerVerbs" . | nindent 4 }}
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
       - unmanagedmachines/status
     verbs: {{ include "rbac.viewerVerbs" . | nindent 4 }}