add permissions required by endpoints controller for blockOwnerDeletion

This commit is contained in:
David Eads 2020-07-28 13:13:38 -04:00
parent 8d74486a6a
commit 7c25f39eb8
2 changed files with 10 additions and 0 deletions

View File

@ -168,6 +168,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
// The controller needs to be able to set a service's finalizers to be able to create an EndpointSlice
// resource that is owned by the service and sets blockOwnerDeletion=true in its ownerRef.
rbacv1helpers.NewRule("update").Groups(legacyGroup).Resources("services/finalizers").RuleOrDie(),
// The controller needs to be able to set a service's finalizers to be able to create an EndpointSlice
// resource that is owned by the endpoint and sets blockOwnerDeletion=true in its ownerRef.
// see https://github.com/openshift/kubernetes/blob/8691466059314c3f7d6dcffcbb76d14596ca716c/pkg/controller/endpointslicemirroring/utils.go#L87-L88
rbacv1helpers.NewRule("update").Groups(legacyGroup).Resources("endpoints/finalizers").RuleOrDie(),
rbacv1helpers.NewRule("get", "list", "create", "update", "delete").Groups(discoveryGroup).Resources("endpointslices").RuleOrDie(),
eventsRule(),
},

View File

@ -544,6 +544,12 @@ items:
- services/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- endpoints/finalizers
verbs:
- update
- apiGroups:
- discovery.k8s.io
resources: