grant permissions on project secrets to admins as projects are created

Signed-off-by: Kent Rancourt <kent.rancourt@gmail.com>
akuity · Feb 27, 2024 · 4939335 · 4939335
1 parent 3c6a282
commit 4939335
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/internal/controller/management/projects/projects.go b/internal/controller/management/projects/projects.go
@@ -319,6 +319,11 @@ func (r *reconciler) ensureSecretPermissions(
 				Name:      "kargo-api",
 				Namespace: r.cfg.KargoNamespace,
 			},
+			{
+				Kind:      "ServiceAccount",
+				Name:      "kargo-admin",
+				Namespace: r.cfg.KargoNamespace,
+			},
 		},
 	}
 	if err := r.createRoleBindingFn(ctx, roleBinding); err != nil {

diff --git a/internal/webhook/project/webhook.go b/internal/webhook/project/webhook.go
@@ -303,6 +303,11 @@ func (w *webhook) ensureSecretPermissions(
 				Name:      "kargo-api",
 				Namespace: w.cfg.KargoNamespace,
 			},
+			{
+				Kind:      "ServiceAccount",
+				Name:      "kargo-admin",
+				Namespace: w.cfg.KargoNamespace,
+			},
 		},
 	}
 	if err := w.createRoleBindingFn(ctx, roleBinding); err != nil {