Ensure postgresclusters are available to admin/edit/view clusterroles

See https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles Signed-off-by: Mathieu Parent <math.parent@gmail.com>
CrunchyData · Nov 15, 2021 · 5688126 · 5688126
1 parent 735d48a
commit 5688126
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 0 deletions.
diff --git a/helm/install/templates/clusterrole-aggregate-edit.yaml b/helm/install/templates/clusterrole-aggregate-edit.yaml
@@ -0,0 +1,22 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Chart.Name }}-aggregate-edit
+  labels:
+    {{- include "install.labels" . | nindent 4 }}
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+rules:
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - postgresclusters
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
diff --git a/helm/install/templates/clusterrole-aggregate-view.yaml b/helm/install/templates/clusterrole-aggregate-view.yaml
@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Chart.Name }}-aggregate-view
+  labels:
+    {{- include "install.labels" . | nindent 4 }}
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - postgresclusters
+  verbs:
+  - get
+  - list
+  - watch