Merge pull request #3465 from LorcanMcVeigh/lorcan/add-deployments-fo…

…r-waf

[RS-2023] Change services permissions to deployments permissions

pkg/render/apiserver.go

@@ -1537,8 +1537,8 @@ func (c *apiServerComponent) tigeraUserClusterRole() *rbacv1.ClusterRole {
 		},
 		// Allow the user to read services to view WAF configuration.
 		{
-			APIGroups: []string{""},
-			Resources: []string{"services"},
+			APIGroups: []string{"apps"},
+			Resources: []string{"deployments"},
 			Verbs:     []string{"get", "list", "watch"},
 		},
 		// Allow the user to read felixconfigurations to detect if wireguard and/or other features are enabled.
@@ -1703,10 +1703,10 @@ func (c *apiServerComponent) tigeraNetworkAdminClusterRole() *rbacv1.ClusterRole
 			Resources: []string{"applicationlayers", "packetcaptureapis", "compliances", "intrusiondetections"},
 			Verbs:     []string{"get", "update", "patch", "create", "delete"},
 		},
-		// Allow the user to read services to view WAF configuration.
+		// Allow the user to read deployments to view WAF configuration.
 		{
-			APIGroups: []string{""},
-			Resources: []string{"services"},
+			APIGroups: []string{"apps"},
+			Resources: []string{"deployments"},
 			Verbs:     []string{"get", "list", "watch", "patch"},
 		},
 		// Allow the user to read felixconfigurations to detect if wireguard and/or other features are enabled.

pkg/render/apiserver_test.go

@@ -1339,8 +1339,8 @@ var (
 			Verbs:     []string{"get"},
 		},
 		{
-			APIGroups: []string{""},
-			Resources: []string{"services"},
+			APIGroups: []string{"apps"},
+			Resources: []string{"deployments"},
 			Verbs:     []string{"get", "list", "watch"},
 		},
 		{
@@ -1467,8 +1467,8 @@ var (
 			Verbs:     []string{"get", "update", "patch", "create", "delete"},
 		},
 		{
-			APIGroups: []string{""},
-			Resources: []string{"services"},
+			APIGroups: []string{"apps"},
+			Resources: []string{"deployments"},
 			Verbs:     []string{"get", "list", "watch", "patch"},
 		},
 		{