From 7c25f39eb8655fbc08c61908c9ff98a0fdc37cfd Mon Sep 17 00:00:00 2001
From: David Eads <deads@redhat.com>
Date: Tue, 28 Jul 2020 13:13:38 -0400
Subject: [PATCH] add permissions required by endpoints controller for
 blockOwnerDeletion

---
 .../authorizer/rbac/bootstrappolicy/controller_policy.go    | 4 ++++
 .../rbac/bootstrappolicy/testdata/controller-roles.yaml     | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
index 73ab507eb1b..f11a0412223 100644
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go
@@ -168,6 +168,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
 				// The controller needs to be able to set a service's finalizers to be able to create an EndpointSlice
 				// resource that is owned by the service and sets blockOwnerDeletion=true in its ownerRef.
 				rbacv1helpers.NewRule("update").Groups(legacyGroup).Resources("services/finalizers").RuleOrDie(),
+				// The controller needs to be able to set a service's finalizers to be able to create an EndpointSlice
+				// resource that is owned by the endpoint and sets blockOwnerDeletion=true in its ownerRef.
+				// see https://github.com/openshift/kubernetes/blob/8691466059314c3f7d6dcffcbb76d14596ca716c/pkg/controller/endpointslicemirroring/utils.go#L87-L88
+				rbacv1helpers.NewRule("update").Groups(legacyGroup).Resources("endpoints/finalizers").RuleOrDie(),
 				rbacv1helpers.NewRule("get", "list", "create", "update", "delete").Groups(discoveryGroup).Resources("endpointslices").RuleOrDie(),
 				eventsRule(),
 			},
diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
index e3b8272e11e..eb01c90a42a 100644
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml
@@ -544,6 +544,12 @@ items:
     - services/finalizers
     verbs:
     - update
+  - apiGroups:
+    - ""
+    resources:
+    - endpoints/finalizers
+    verbs:
+    - update
   - apiGroups:
     - discovery.k8s.io
     resources: