fix: rbac rules

Author: CasLubbers

charts/apl-operator/templates/rbac.yaml

@@ -119,37 +119,9 @@ kind: ClusterRole
 metadata:
   name: apl-operator-crds
 rules:
-  # Required for applying the Prometheus CRDs
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "create", "update", "patch"]
-    resourceNames:
-      - "alertmanagerconfigs.monitoring.coreos.com"
-      - "alertmanagers.monitoring.coreos.com"
-      - "podmonitors.monitoring.coreos.com"
-      - "probes.monitoring.coreos.com"
-      - "prometheuses.monitoring.coreos.com"
-      - "prometheusrules.monitoring.coreos.com"
-      - "servicemonitors.monitoring.coreos.com"
-      - "thanosrulers.monitoring.coreos.com"
-
-  # Required for applying Tekton Triggers CRDs
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "create", "update", "patch"]
-    resourceNames:
-      - "clusterinterceptors.triggers.tekton.dev"
-      - "clustertriggerbindings.triggers.tekton.dev"
-      - "eventlisteners.triggers.tekton.dev"
-      - "interceptors.triggers.tekton.dev"
-      - "triggers.triggers.tekton.dev"
-      - "triggerbindings.triggers.tekton.dev"
-      - "triggertemplates.triggers.tekton.dev"
-
-  # For listing CRDs (needed to check existence)
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["list"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -163,3 +135,27 @@ roleRef:
   kind: ClusterRole
   name: apl-operator-crds
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: apl-operator-configmap-manager
+  namespace: otomi
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: apl-operator-configmap-manager-binding
+  namespace: otomi
+subjects:
+  - kind: ServiceAccount
+    name: apl-operator
+    namespace: apl-operator
+roleRef:
+  kind: Role
+  name: apl-operator-configmap-manager
+  apiGroup: rbac.authorization.k8s.io