chore: change cluster roles

Signed-off-by: Rory Z <[email protected]>
emqx · Sep 4, 2023 · 4aeb874 · 4aeb874
1 parent f403893
commit 4aeb874
Show file tree

Hide file tree

Showing 5 changed files with 23 additions and 112 deletions.
diff --git a/RELEASE.md b/RELEASE.md
@@ -1,6 +1,6 @@
 # Release Note 🍻
 
-EMQX Operator 2.2.2-rc.2 has been released.
+EMQX Operator 2.2.2-rc.3 has been released.
 
 ## Supported version
 + apps.emqx.io/v2beta1
@@ -29,7 +29,7 @@ helm repo update
 helm upgrade --install emqx-operator emqx/emqx-operator \
   --namespace emqx-operator-system \
   --create-namespace \
-  --version 2.2.2-rc.2
+  --version 2.2.2-rc.3
 kubectl wait --for=condition=Ready pods -l "control-plane=controller-manager" -n emqx-operator-system
 ```
 

diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -13,18 +13,6 @@ rules:
   - create
   - get
   - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - endpoints
-  verbs:
-  - create
-  - get
-  - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -35,7 +23,6 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -44,9 +31,9 @@ rules:
   - persistentvolumeclaims
   verbs:
   - create
+  - delete
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -57,41 +44,15 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
   - ""
   resources:
   - pods
   verbs:
-  - create
   - get
   - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - pods/exec
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - pods/portforward
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - ""
@@ -107,7 +68,6 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -118,7 +78,6 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -127,9 +86,9 @@ rules:
   - replicasets
   verbs:
   - create
+  - delete
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -138,9 +97,9 @@ rules:
   - statefulsets
   verbs:
   - create
+  - delete
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -282,3 +241,4 @@ rules:
   - get
   - list
   - update
+  - watch
diff --git a/deploy/charts/emqx-operator/Chart.yaml b/deploy/charts/emqx-operator/Chart.yaml
@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.2.2-rc.2
+version: 2.2.2-rc.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 2.2.2-rc.2
+appVersion: 2.2.2-rc.3
diff --git a/deploy/charts/emqx-operator/templates/controller-manager-rbac.yaml b/deploy/charts/emqx-operator/templates/controller-manager-rbac.yaml
@@ -42,7 +42,6 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -53,7 +52,6 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -62,9 +60,9 @@ rules:
   - persistentvolumeclaims
   verbs:
   - create
+  - delete
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -75,41 +73,15 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
   - ""
   resources:
   - pods
   verbs:
-  - create
   - get
   - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - pods/exec
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - pods/portforward
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - ""
@@ -125,7 +97,6 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -136,7 +107,6 @@ rules:
   - create
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -145,9 +115,9 @@ rules:
   - replicasets
   verbs:
   - create
+  - delete
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -156,9 +126,9 @@ rules:
   - statefulsets
   verbs:
   - create
+  - delete
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
@@ -167,6 +137,7 @@ rules:
   - emqxbrokers
   verbs:
   - create
+  - delete
   - get
   - list
   - patch
@@ -192,6 +163,7 @@ rules:
   - emqxenterprises
   verbs:
   - create
+  - delete
   - get
   - list
   - patch
@@ -211,14 +183,6 @@ rules:
   - get
   - patch
   - update
-- apiGroups:
-  - apps.emqx.io
-  resources:
-  - emqxenterprises/status
-  verbs:
-  - get
-  - patch
-  - update
 - apiGroups:
   - apps.emqx.io
   resources:
@@ -306,15 +270,5 @@ rules:
   - get
   - list
   - update
-- apiGroups:
-  - ""
-  resources:
-  - endpoints
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
   - watch
 {{- end }}
diff --git a/main.go b/main.go
@@ -59,20 +59,17 @@ func init() {
 	//+kubebuilder:scaffold:scheme
 }
 
-//+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups="",resources=pods/exec,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups="",resources=pods/portforward,verbs=get;list;watch;create;update;patch
+//+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update
+//+kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;create;update
+//+kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=get;list;watch;create;update
+//+kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch
 //+kubebuilder:rbac:groups="",resources=pods/status,verbs=patch
-//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups=apps,resources=replicasets,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups="",resources=endpoints,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;create;update
+//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update
+//+kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update
+//+kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups=apps,resources=replicasets,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update
 
 func main() {
 	var metricsAddr string