Merge branch 'no-star-roles' into 'master'

[RBAC] remove the usage of star perms in operand roles See merge request nvidia/kubernetes/gpu-operator!1095
NVIDIA · Jun 5, 2024 · 0a321eb · 0a321eb
2 parents 58afc29 + 5907063
commit 0a321eb
Show file tree

Hide file tree

Showing 6 changed files with 26 additions and 17 deletions.
diff --git a/assets/state-driver/0210_clusterrole.yaml b/assets/state-driver/0210_clusterrole.yaml
@@ -35,9 +35,6 @@ rules:
 - apiGroups:
   - apps
   resources:
-  - deployments
   - daemonsets
-  - replicasets
-  - statefulsets
   verbs:
-  - '*'
+  - get
diff --git a/assets/state-mig-manager/0200_role.yaml b/assets/state-mig-manager/0200_role.yaml
@@ -17,4 +17,7 @@ rules:
   resources:
   - pods
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - delete
diff --git a/assets/state-mig-manager/0210_clusterrole.yaml b/assets/state-mig-manager/0210_clusterrole.yaml
@@ -8,4 +8,8 @@ rules:
   resources:
   - nodes
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - update
+  - patch
diff --git a/assets/state-node-status-exporter/0300_clusterrole.yaml b/assets/state-node-status-exporter/0300_clusterrole.yaml
@@ -8,4 +8,6 @@ rules:
   resources:
   - nodes
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
diff --git a/assets/state-operator-validation/0200_role.yaml b/assets/state-operator-validation/0200_role.yaml
@@ -17,11 +17,18 @@ rules:
   resources:
   - pods
   verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
 - apiGroups:
   - apps
   resources:
-  - deployments
   - daemonsets
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
diff --git a/assets/state-operator-validation/0210_clusterrole.yaml b/assets/state-operator-validation/0210_clusterrole.yaml
@@ -8,10 +8,6 @@ rules:
   resources:
   - nodes
   verbs:
-  - '*'
-- apiGroups:
-  - nvidia.com
-  resources:
-  - clusterpolicies/finalizers
-  verbs:
-  - '*'
+  - get
+  - list
+  - watch
-Original file line number
+Diff line change
@@ Expand Up / @@ -17,4 +17,7 @@ rules: @@
       resources:
       - pods
       verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - delete