operator-framework-operator-controller/test/e2e/steps/testdata/olm-sa-boxcutter-no-create-rbac-template.yaml at 55b6193e00f5b9c280edf38c222a398d4ceb0b7a · openshift/operator-framework-operator-controller · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
---
apiVersion: v1
kind: Namespace
metadata:
  name: ${TEST_NAMESPACE}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ${TEST_NAMESPACE}-${SERVICEACCOUNT_NAME}-olm-admin-clusterrole
rules:
  # Allow management of ClusterExtensionRevision finalizers (e.g. by the Boxcutter applier)
  - apiGroups: [olm.operatorframework.io]
    resources: [clusterextensionrevisions/finalizers]
    verbs: [update, patch]
  # OLMv0 compatibility requirement for AllNamespaces install
  # https://github.com/operator-framework/operator-lifecycle-manager/blob/dfd0b2bea85038d3c0d65348bc812d297f16b8d2/pkg/controller/operators/olm/operatorgroup.go#L530
  - apiGroups: [ "" ]
    resources:
      - namespaces
    verbs: [ get, list, watch ]
  # Bundle resource management RBAC derived from bundle resource and permissions described in the ClusterServiceVersion
  # NOTE: Intentionally MISSING "create" verb to test preflight check
  - apiGroups: [apiextensions.k8s.io]
    resources: [customresourcedefinitions]
    verbs: [update, get, delete, patch]
  - apiGroups: [""]
    resources:
      - configmaps
      - serviceaccounts
    verbs: [update, list, watch, get, delete, patch]
  - apiGroups: [ "" ]
    resources:
      - events
    verbs: [ patch ]
  - apiGroups: ["apps"]
    resources:
      - deployments
    verbs: [ update, get, delete, patch ]
  - apiGroups: ["networking.k8s.io"]
    resources:
      - networkpolicies
    verbs: [update, list, get, delete, patch]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources:
      - clusterroles
      - roles
      - clusterrolebindings
      - rolebindings
    verbs: [ update, get, delete, patch ]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: [update, list, watch, get, delete, patch]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: [create]
  - apiGroups: ["authentication.k8s.io"]
    resources: ["tokenreviews"]
    verbs: [create]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ${TEST_NAMESPACE}-${SERVICEACCOUNT_NAME}-install-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ${TEST_NAMESPACE}-${SERVICEACCOUNT_NAME}-olm-admin-clusterrole
subjects:
  - kind: ServiceAccount
    name: ${SERVICEACCOUNT_NAME}
    namespace: ${TEST_NAMESPACE}