Merge pull request #66 from flanksource/moshloop

fix: update rbac for namespace watch
flanksource · May 2, 2021 · c819ab5 · c819ab5
2 parents 6dda280 + f8c2546
commit c819ab5
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 4 deletions.
diff --git a/config/deploy/base.yml b/config/deploy/base.yml
@@ -108,6 +108,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - ""
   resources:

diff --git a/config/deploy/manifests.yaml b/config/deploy/manifests.yaml
@@ -9,7 +9,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+    cert-manager.io/inject-ca-from: platform-system/platform-serving-cert
     controller-gen.kubebuilder.io/version: v0.5.0
   creationTimestamp: null
   name: clusterresourcequotas.platform.flanksource.com
@@ -189,7 +189,7 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+    cert-manager.io/inject-ca-from: platform-system/platform-serving-cert
   creationTimestamp: null
   name: platform-mutating-webhook-configuration
   namespace: platform-system
@@ -241,7 +241,7 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+    cert-manager.io/inject-ca-from: platform-system/platform-serving-cert
   creationTimestamp: null
   name: platform-validating-webhook-configuration
   namespace: platform-system
@@ -397,6 +397,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - ""
   resources:

diff --git a/config/operator/rbac/role.yaml b/config/operator/rbac/role.yaml
@@ -13,6 +13,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - ""
   resources:

diff --git a/pkg/controllers/pod/pod_reconciler.go b/pkg/controllers/pod/pod_reconciler.go
@@ -62,7 +62,7 @@ func addPodReconciler(mgr manager.Manager, r reconcile.Reconciler) error {
 }
 
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;create;update
-// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list
+// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;update;watch
 
 func (r *PodReconciler) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) {