03_pelorus_operators_roles.diff

--- config/rbac/kustomization.yaml.original		2023-04-06 10:51:58.252397321 +0200
+++ config/rbac/kustomization.yaml	2023-04-06 11:07:11.076162392 +0200
@@ -7,6 +7,8 @@ resources:
 - service_account.yaml
 - role.yaml
 - role_binding.yaml
+- pelorus_manager_role.yaml
+- pelorus_role_binding.yaml
 - leader_election_role.yaml
 - leader_election_role_binding.yaml
 # Comment the following 4 lines if you want to disable
--- /dev/null	2023-03-27 08:53:50.880018007 +0200
+++ config/rbac/pelorus_manager_role.yaml	2023-04-06 11:07:11.077162391 +0200
@@ -0,0 +1,104 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pelorus-manager-role
+rules:
+# Needed to create or delete Prometheus and Grafana subscriptions
+- apiGroups:
+  - "operators.coreos.com"
+  resources:
+  - "operatorgroups"
+  - "subscriptions"
+  verbs:
+  - get
+  - create
+  - delete
+  - list
+  - watch
+- apiGroups:
+  - "batch"
+  resources:
+  - "jobs"
+  verbs:
+  - list
+  - create
+  - get
+  - watch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - "serviceaccounts"
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+# Pelorus require new role to allow installplan approval job
+- apiGroups:
+  - "rbac.authorization.k8s.io"
+  resources:
+  - "roles"
+  - "rolebindings"
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - delete
+# Required to grand permissions to the installplan-approver user
+- apiGroups:
+  - "operators.coreos.com"
+  resources:
+  - "installplans"
+  - "subscriptions"
+  verbs:
+  - get
+  - list
+  - patch
+# Required to grand permissions to the csv-deleter / attempting to grant RBAC permissions not currently held
+- apiGroups:
+  - "operators.coreos.com"
+  resources:
+  - "clusterserviceversions"
+  verbs:
+  - delete
+  - list
+# Required by the Grafana and Prometheus operators
+- apiGroups:
+  - "integreatly.org"
+  resources:
+  - "grafanas"
+  - "grafanadashboards"
+  - "grafanadatasources"
+  - "grafananotificationchannels"
+  verbs:
+  - list
+  - get
+  - watch
+  - create
+  - delete
+# Required to build and deploy exporters from the source code
+- apiGroups:
+  - "build.openshift.io"
+  resources:
+  - "buildconfigs"
+  verbs:
+  - get
+  - create
+  - delete
+  - list
+  - watch
+  - patch
+# Required to deploy Thanos
+- apiGroups:
+  - "apps"
+  resources:
+  - "deployments"
+  verbs:
+  - get
+  - create
+  - delete
+  - list
+  - watch
+
--- /dev/null	2023-03-27 08:53:50.880018007 +0200
+++ config/rbac/pelorus_role_binding.yaml	2023-04-06 11:07:11.077162391 +0200
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pelorus-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pelorus-manager-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system