diff options
| author | zivAnyvision <ziv@oosto.com> | 2021-12-09 08:29:19 +0200 |
|---|---|---|
| committer | zivAnyvision <ziv@oosto.com> | 2021-12-21 08:51:40 +0200 |
| commit | b9b3a575d8ca44d4010e9859418819e61501ad6c (patch) | |
| tree | f3c3e78e90021d99a2674edb1ba8e2838ca6e6c4 /build | |
| parent | Merge pull request #3473 from zhu733756/helm-ci (diff) | |
| download | kubeedge-b9b3a575d8ca44d4010e9859418819e61501ad6c.tar.gz | |
Add missing resource permissions to cloudcore ClusterRole
Signed-off-by: zivAnyvision <ziv@oosto.com>
Diffstat (limited to 'build')
| -rw-r--r-- | build/cloud/03-clusterrole.yaml | 7 | ||||
| -rw-r--r-- | build/cloud/ha/01-ha-prepare.yaml | 7 | ||||
| -rw-r--r-- | build/helm/cloudcore/templates/rbac_cloudcore.yaml | 2 |
3 files changed, 11 insertions, 5 deletions
diff --git a/build/cloud/03-clusterrole.yaml b/build/cloud/03-clusterrole.yaml index b05afb804..f4ba01584 100644 --- a/build/cloud/03-clusterrole.yaml +++ b/build/cloud/03-clusterrole.yaml @@ -7,13 +7,13 @@ metadata: kubeedge: cloudcore rules: - apiGroups: [""] - resources: ["nodes", "nodes/status", "configmaps", "pods", "pods/status", "secrets", "endpoints", "services","persistentvolumes","persistentvolumeclaims"] + resources: ["nodes", "nodes/status", "serviceaccounts/token", "configmaps", "pods", "pods/status", "secrets", "endpoints", "services", "persistentvolumes", "persistentvolumeclaims"] verbs: ["get", "list", "watch", "create", "update"] - apiGroups: [""] resources: ["namespaces"] verbs: ["get", "create"] - apiGroups: [""] - resources: ["pods/status"] + resources: ["nodes", "pods/status"] verbs: ["patch"] - apiGroups: [""] resources: ["pods"] @@ -33,3 +33,6 @@ rules: - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +- apiGroups: ["networking.istio.io"] + resources: ["*"] + verbs: ["get", "list", "watch"] diff --git a/build/cloud/ha/01-ha-prepare.yaml b/build/cloud/ha/01-ha-prepare.yaml index 01b4a2fc2..24d966eae 100644 --- a/build/cloud/ha/01-ha-prepare.yaml +++ b/build/cloud/ha/01-ha-prepare.yaml @@ -26,13 +26,13 @@ metadata: kubeedge: cloudcore rules: - apiGroups: [""] - resources: ["nodes", "nodes/status", "configmaps", "pods", "pods/status", "secrets", "endpoints", "services","persistentvolumes","persistentvolumeclaims"] + resources: ["nodes", "nodes/status", "serviceaccounts/token", "configmaps", "pods", "pods/status", "secrets", "endpoints", "services", "persistentvolumes", "persistentvolumeclaims"] verbs: ["get", "list", "watch", "create", "update"] - apiGroups: [""] resources: ["namespaces"] verbs: ["get", "create"] - apiGroups: [""] - resources: ["pods/status"] + resources: ["nodes", "pods/status"] verbs: ["patch"] - apiGroups: [""] resources: ["pods"] @@ -52,6 +52,9 @@ rules: - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["networking.istio.io"] + resources: ["*"] + verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 diff --git a/build/helm/cloudcore/templates/rbac_cloudcore.yaml b/build/helm/cloudcore/templates/rbac_cloudcore.yaml index a711159ce..df6d7a462 100644 --- a/build/helm/cloudcore/templates/rbac_cloudcore.yaml +++ b/build/helm/cloudcore/templates/rbac_cloudcore.yaml @@ -8,7 +8,7 @@ metadata: {{- end }} rules: - apiGroups: [""] - resources: ["nodes", "nodes/status", "serviceaccounts/token", "configmaps", "pods", "pods/status", "secrets", "endpoints", "services","persistentvolumes","persistentvolumeclaims"] + resources: ["nodes", "nodes/status", "serviceaccounts/token", "configmaps", "pods", "pods/status", "secrets", "endpoints", "services", "persistentvolumes", "persistentvolumeclaims"] verbs: ["get", "list", "watch", "create", "update"] - apiGroups: [""] resources: ["namespaces"] |