Add RBAC permissions so Linseed can operate on secrets and configmaps #2883
Conversation
| { | ||
| APIGroups: []string{""}, | ||
| Resources: []string{"secrets"}, | ||
| Verbs: []string{"get", "list", "watch"}, |
There was a problem hiding this comment.
I think we can include a ResourceNames section here to limit specifically to the secret we want to copy, no? It should always be a well-known secret name + namespace.
There was a problem hiding this comment.
Let me check this and get back to you. I'm concerned about how well the shared informer's "list" and "watch" will handle an explicit list of ResourceNames.
There was a problem hiding this comment.
I think it's OK to do that in parallel and we can merge this to at least get things working.
It should definitely be possible to have the informer only watch a particular resource, it might require multiple in order to watch multiple resources though.
|
@Josh-Tigera looks like two UTs failing but otherwise I think we can merge |
|
Removing "merge-when-ready" label due to new commits |
|
Removing "merge-when-ready" label due to new commits |
where necessary
Description
For PR author
- [ ] If changing pkg/apis/, runmake gen-files- [ ] If changing versions, runmake gen-versionsFor PR reviewers
A note for code reviewers - all pull requests must have the following:
kind/bugif this is a bugfix.kind/enhancementif this is a a new feature.enterpriseif this PR applies to Calico Enterprise only.