Allow bypassing user name validation

vshn · May 17, 2023 · 84de744 · 84de744
1 parent d2d36ae
commit 84de744
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -109,6 +109,12 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - rbac.appuio.io
+  resources:
+  - users
+  verbs:
+  - create
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

diff --git a/controllers/periodic_syncer.go b/controllers/periodic_syncer.go
@@ -36,6 +36,9 @@ type PeriodicSyncer struct {
 //+kubebuilder:rbac:groups=appuio.io,resources=organizationmembers,verbs=create
 //+kubebuilder:rbac:groups=appuio.io,resources=teams,verbs=create
 //+kubebuilder:rbac:groups=appuio.io,resources=users,verbs=create
+// Allows managing other users than the one used by the controller itself
+// See https://github.com/appuio/control-api/pull/163
+//+kubebuilder:rbac:groups=rbac.appuio.io,resources=users,verbs=create
 //+kubebuilder:rbac:groups=organization.appuio.io;rbac.appuio.io,resources=organizations,verbs=create
 //+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=subjects;rolebindings,verbs=*