Skip to content

Commit

Permalink
add RBAC annotation for status subresource
Browse files Browse the repository at this point in the history
  • Loading branch information
droot committed Nov 28, 2018
1 parent 86180a2 commit 2d6bc05
Show file tree
Hide file tree
Showing 7 changed files with 56 additions and 0 deletions.
2 changes: 2 additions & 0 deletions pkg/scaffold/controller/controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -194,8 +194,10 @@ type Reconcile{{ .Resource.Kind }} struct {
{{ if .Resource.CreateExampleReconcileBody -}}
// Automatically generate RBAC rules to allow the Controller to read and write Deployments
// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=apps,resources=deployments/status,verbs=get;update;patch
{{ end -}}
// +kubebuilder:rbac:groups={{.GroupDomain}},resources={{ .Plural }},verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups={{.GroupDomain}},resources={{ .Plural }}/status,verbs=get;update;patch
func (r *Reconcile{{ .Resource.Kind }}) Reconcile(request reconcile.Request) (reconcile.Result, error) {
// Fetch the {{ .Resource.Kind }} instance
instance := &{{ .Resource.Group}}{{ .Resource.Version }}.{{ .Resource.Kind }}{}
Expand Down
48 changes: 48 additions & 0 deletions test/project/config/rbac/rbac_role.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,14 @@ rules:
- update
- patch
- delete
- apiGroups:
- apps
resources:
- deployments/status
verbs:
- get
- update
- patch
- apiGroups:
- crew.testproject.org
resources:
Expand All @@ -28,6 +36,14 @@ rules:
- update
- patch
- delete
- apiGroups:
- crew.testproject.org
resources:
- firstmates/status
verbs:
- get
- update
- patch
- apiGroups:
- ship.testproject.org
resources:
Expand All @@ -40,6 +56,14 @@ rules:
- update
- patch
- delete
- apiGroups:
- ship.testproject.org
resources:
- frigates/status
verbs:
- get
- update
- patch
- apiGroups:
- policy.testproject.org
resources:
Expand All @@ -52,6 +76,14 @@ rules:
- update
- patch
- delete
- apiGroups:
- policy.testproject.org
resources:
- healthcheckpolicies/status
verbs:
- get
- update
- patch
- apiGroups:
- creatures.testproject.org
resources:
Expand All @@ -64,6 +96,14 @@ rules:
- update
- patch
- delete
- apiGroups:
- creatures.testproject.org
resources:
- krakens/status
verbs:
- get
- update
- patch
- apiGroups:
- ""
resources:
Expand All @@ -76,6 +116,14 @@ rules:
- update
- patch
- delete
- apiGroups:
- ""
resources:
- namespaces/status
verbs:
- get
- update
- patch
- apiGroups:
- admissionregistration.k8s.io
resources:
Expand Down
2 changes: 2 additions & 0 deletions test/project/pkg/controller/firstmate/firstmate_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,9 @@ type ReconcileFirstMate struct {
// a Deployment as an example
// Automatically generate RBAC rules to allow the Controller to read and write Deployments
// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=apps,resources=deployments/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=crew.testproject.org,resources=firstmates,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=crew.testproject.org,resources=firstmates/status,verbs=get;update;patch
func (r *ReconcileFirstMate) Reconcile(request reconcile.Request) (reconcile.Result, error) {
// Fetch the FirstMate instance
instance := &crewv1.FirstMate{}
Expand Down
1 change: 1 addition & 0 deletions test/project/pkg/controller/frigate/frigate_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ type ReconcileFrigate struct {
// TODO(user): Modify this Reconcile function to implement your Controller logic. The scaffolding writes
// a Deployment as an example
// +kubebuilder:rbac:groups=ship.testproject.org,resources=frigates,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=ship.testproject.org,resources=frigates/status,verbs=get;update;patch
func (r *ReconcileFrigate) Reconcile(request reconcile.Request) (reconcile.Result, error) {
// Fetch the Frigate instance
instance := &shipv1beta1.Frigate{}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ type ReconcileHealthCheckPolicy struct {
// TODO(user): Modify this Reconcile function to implement your Controller logic. The scaffolding writes
// a Deployment as an example
// +kubebuilder:rbac:groups=policy.testproject.org,resources=healthcheckpolicies,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=policy.testproject.org,resources=healthcheckpolicies/status,verbs=get;update;patch
func (r *ReconcileHealthCheckPolicy) Reconcile(request reconcile.Request) (reconcile.Result, error) {
// Fetch the HealthCheckPolicy instance
instance := &policyv1beta1.HealthCheckPolicy{}
Expand Down
1 change: 1 addition & 0 deletions test/project/pkg/controller/kraken/kraken_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ type ReconcileKraken struct {
// TODO(user): Modify this Reconcile function to implement your Controller logic. The scaffolding writes
// a Deployment as an example
// +kubebuilder:rbac:groups=creatures.testproject.org,resources=krakens,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=creatures.testproject.org,resources=krakens/status,verbs=get;update;patch
func (r *ReconcileKraken) Reconcile(request reconcile.Request) (reconcile.Result, error) {
// Fetch the Kraken instance
instance := &creaturesv2alpha1.Kraken{}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ type ReconcileNamespace struct {
// TODO(user): Modify this Reconcile function to implement your Controller logic. The scaffolding writes
// a Deployment as an example
// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=core,resources=namespaces/status,verbs=get;update;patch
func (r *ReconcileNamespace) Reconcile(request reconcile.Request) (reconcile.Result, error) {
// Fetch the Namespace instance
instance := &corev1.Namespace{}
Expand Down

0 comments on commit 2d6bc05

Please sign in to comment.