Add poollet permissions for certificate signing

ironcore-dev · Mar 27, 2023 · 4a28dda · 4a28dda
1 parent 961a88f
commit 4a28dda
Show file tree

Hide file tree

Showing 9 changed files with 96 additions and 0 deletions.
diff --git a/config/apiserver/rbac/bucketpool_role.yaml b/config/apiserver/rbac/bucketpool_role.yaml
@@ -16,6 +16,21 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/bucketpoolclient
+  verbs:
+  - create
 - apiGroups:
   - storage.api.onmetal.de
   resources:

diff --git a/config/apiserver/rbac/machinepool_role.yaml b/config/apiserver/rbac/machinepool_role.yaml
@@ -16,6 +16,21 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/machinepoolclient
+  verbs:
+  - create
 - apiGroups:
   - compute.api.onmetal.de
   resources:

diff --git a/config/apiserver/rbac/volumepool_role.yaml b/config/apiserver/rbac/volumepool_role.yaml
@@ -16,6 +16,21 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/volumepoolclient
+  verbs:
+  - create
 - apiGroups:
   - storage.api.onmetal.de
   resources:

diff --git a/config/bucketpoollet-broker/poollet-rbac/role.yaml b/config/bucketpoollet-broker/poollet-rbac/role.yaml
@@ -16,6 +16,21 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/bucketpoolclient
+  verbs:
+  - create
 - apiGroups:
   - storage.api.onmetal.de
   resources:

diff --git a/config/machinepoollet-broker/poollet-rbac/role.yaml b/config/machinepoollet-broker/poollet-rbac/role.yaml
@@ -16,6 +16,21 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/machinepoolclient
+  verbs:
+  - create
 - apiGroups:
   - compute.api.onmetal.de
   resources:

diff --git a/config/volumepoollet-broker/poollet-rbac/role.yaml b/config/volumepoollet-broker/poollet-rbac/role.yaml
@@ -16,6 +16,21 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/volumepoolclient
+  verbs:
+  - create
 - apiGroups:
   - storage.api.onmetal.de
   resources:

diff --git a/poollet/bucketpoollet/controllers/rbac.go b/poollet/bucketpoollet/controllers/rbac.go
@@ -18,3 +18,5 @@ package controllers
 
 // Rules required for kubeconfig-rotation
 //+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch
+//+kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests,verbs=create;get;list;watch
+//+kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests/bucketpoolclient,verbs=create
diff --git a/poollet/machinepoollet/controllers/rbac.go b/poollet/machinepoollet/controllers/rbac.go
@@ -18,3 +18,5 @@ package controllers
 
 // Rules required for kubeconfig-rotation
 //+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch
+//+kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests,verbs=create;get;list;watch
+//+kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests/machinepoolclient,verbs=create
diff --git a/poollet/volumepoollet/controllers/rbac.go b/poollet/volumepoollet/controllers/rbac.go
@@ -18,3 +18,5 @@ package controllers
 
 // Rules required for kubeconfig-rotation
 //+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch
+//+kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests,verbs=create;get;list;watch
+//+kubebuilder:rbac:groups=certificates.k8s.io,resources=certificatesigningrequests/volumepoolclient,verbs=create