Fix the permissions in config/rbac/bases/operator/role.yaml

[paulzhang97]

Related to #154, config/rbac/bases/operator/role.yaml is actually pulled by Cloud, need to add the permissions to it.

[RafalKorepta]

LGHT with none blocking comment

[RafalKorepta]

I normally add watch verb to the list below. Yet the code that checks storage class is within webook, so it might not have proper client cache configured

[paulzhang97]

Added.

[chrisseto]

This file should be generated by kubebuilder when you run task k8s:manifests (or something similar). You can affect how that file is generated by adding kubebuilder markers/directives above the controller. There should be a big block that exists already and just needs to have priorityclasses add. Can you add it there and then regenerate this file?

[paulzhang97]

This file should be generated by kubebuilder when you run task k8s:manifests (or something similar). You can affect how that file is generated by adding kubebuilder markers/directives above the controller. There should be a big block that exists already and just needs to have priorityclasses add. Can you add it there and then regenerate this file?

Let me try.

[paulzhang97]

Added the marker. I only added it for ClusterRole. I don't think we need to add it to Role. Let me know if otherwise.

[chrisseto]

Ah, sorry this should be added above the controller that's actually using those permissions

redpanda-operator/src/go/k8s/internal/controller/redpanda/cluster_controller.go

Lines 82 to 99 in dd0c3ad

	//+kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;update;patch;delete
	//+kubebuilder:rbac:groups=cert-manager.io,resources=issuers;certificates,verbs=create;get;list;watch;patch;delete;update;
	//+kubebuilder:rbac:groups=cert-manager.io,resources=clusterissuers,verbs=create;get;list;watch;patch;delete;update;
	//+kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
	//+kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch
	//+kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch;delete;
	//+kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;update;delete
	//+kubebuilder:rbac:groups=core,resources=pods/finalizers,verbs=update
	//+kubebuilder:rbac:groups=core,resources=pods/status,verbs=update;patch
	//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;
	//+kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;update;patch;
	//+kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;
	//+kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=create;get;list;watch;patch;delete;update;
	//+kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=create;get;list;watch;patch;delete;update;
	//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings,verbs=get;list;watch;create;update;patch;
	//+kubebuilder:rbac:groups=redpanda.vectorized.io,resources=clusters,verbs=get;list;watch;create;update;patch;delete
	//+kubebuilder:rbac:groups=redpanda.vectorized.io,resources=clusters/finalizers,verbs=update
	//+kubebuilder:rbac:groups=redpanda.vectorized.io,resources=clusters/status,verbs=get;update;patch

[paulzhang97]

Ah, sorry this should be added above the controller that's actually using those permissions

No problem. Done.

[chrisseto]

LGTM!