better rbacs and eliminate warning about kustomize patches

hercynium · Oct 27, 2024 · 057fe6c · 057fe6c
1 parent 0d0bddb
commit 057fe6c
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 16 deletions.
diff --git a/bundle/manifests/istio-fortsa.clusterserviceversion.yaml b/bundle/manifests/istio-fortsa.clusterserviceversion.yaml
@@ -4,7 +4,7 @@ metadata:
   annotations:
     alm-examples: '[]'
     capabilities: Basic Install
-    createdAt: "2024-10-15T02:19:39Z"
+    createdAt: "2024-10-27T01:27:04Z"
     operators.operatorframework.io/builder: operator-sdk-v1.36.1
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
   name: istio-fortsa.v0.0.4
@@ -25,41 +25,55 @@ spec:
           - ""
           resources:
           - events
+          - pods/portforward
+          - serviceaccounts/token
           verbs:
           - create
           - patch
         - apiGroups:
           - ""
           resources:
-          - mutatingwebhookconfigurations
           - namespaces
-          - pods
+          - namespaces/finalizers
+          - namespaces/status
           verbs:
-          - create
-          - delete
           - get
           - list
-          - patch
-          - update
           - watch
         - apiGroups:
           - ""
           resources:
-          - mutatingwebhookconfigurations/finalizers
-          - namespaces/finalizers
+          - pods
           - pods/finalizers
+          - pods/status
           verbs:
+          - get
+          - list
+          - patch
           - update
+          - watch
         - apiGroups:
-          - ""
+          - admissionregistration.k8s.io
           resources:
+          - mutatingwebhookconfigurations
+          - mutatingwebhookconfigurations/finalizers
           - mutatingwebhookconfigurations/status
-          - namespaces/status
-          - pods/status
           verbs:
           - get
+          - list
+          - watch
+        - apiGroups:
+          - apps
+          resources:
+          - daemonset
+          - deployment
+          - statefulset
+          verbs:
+          - get
+          - list
           - patch
           - update
+          - watch
         - apiGroups:
           - authentication.k8s.io
           resources:
@@ -121,7 +135,7 @@ spec:
                 - --metrics-bind-address=127.0.0.1:8080
                 - --leader-elect
                 command:
-                  - /manager
+                - /manager
                 image: ghcr.io/hercynium/istio-fortsa:0.0.4
                 livenessProbe:
                   httpGet:

diff --git a/config/manifests/kustomization.yaml b/config/manifests/kustomization.yaml
@@ -9,7 +9,7 @@ resources:
 # [WEBHOOK] To enable webhooks, uncomment all the sections with [WEBHOOK] prefix.
 # Do NOT uncomment sections with prefix [CERTMANAGER], as OLM does not support cert-manager.
 # These patches remove the unnecessary "cert" volume and its manager container volumeMount.
-#patchesJson6902:
+#patches:
 #- target:
 #    group: apps
 #    version: v1

diff --git a/config/scorecard/kustomization.yaml b/config/scorecard/kustomization.yaml
@@ -1,6 +1,6 @@
 resources:
 - bases/config.yaml
-patchesJson6902:
+patches:
 - path: patches/basic.config.yaml
   target:
     group: scorecard.operatorframework.io
@@ -13,4 +13,4 @@ patchesJson6902:
     version: v1alpha3
     kind: Configuration
     name: config
-#+kubebuilder:scaffold:patchesJson6902
+#+kubebuilder:scaffold:patches