fix: updating CRD names; including llds editor/viewer roles (#137)

Adds a reference to the config/rbac/llsd_editor_role.yaml and config/rbac/llsd_viewer_role.yaml files to config/rbac/kustomization.yaml so the ClusterRoles get created upon installation.

Fixes: RHAIENG-496


Approved-by: leseb

Author: rhdedgar

config/rbac/kustomization.yaml

@@ -19,3 +19,5 @@ resources:
 - auth_proxy_role.yaml
 - auth_proxy_role_binding.yaml
 - auth_proxy_client_clusterrole.yaml
+- llsd_viewer_role.yaml
+- llsd_editor_role.yaml

config/rbac/llamastack_viewer_role.yaml

@@ -0,0 +1,27 @@
+# permissions for end users to edit LlamaStackDistributions.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: llsd-editor-role
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+rules:
+- apiGroups:
+  - llamastack.io
+  resources:
+  - llamastackdistributions
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - llamastack.io
+  resources:
+  - llamastackdistributions/status
+  verbs:
+  - get

config/rbac/llsd_editor_role.yaml

@@ -1,24 +1,22 @@
-# permissions for end users to edit llamastacks.
+# permissions for end users to view LlamaStackDistributions.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: llamastack-editor-role
+  name: llsd-viewer-role
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
 rules:
 - apiGroups:
   - llamastack.io
   resources:
-  - llamastacks
+  - llamastackdistributions
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - llamastack.io
   resources:
-  - llamastacks/status
+  - llamastackdistributions/status
   verbs:
   - get

config/rbac/llamastack_editor_role.yaml renamed to config/rbac/llsd_viewer_role.yaml

@@ -2265,6 +2265,57 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: llama-stack-k8s-operator
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+  name: llama-stack-k8s-operator-llsd-editor-role
+rules:
+- apiGroups:
+  - llamastack.io
+  resources:
+  - llamastackdistributions
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - llamastack.io
+  resources:
+  - llamastackdistributions/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: llama-stack-k8s-operator
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: llama-stack-k8s-operator-llsd-viewer-role
+rules:
+- apiGroups:
+  - llamastack.io
+  resources:
+  - llamastackdistributions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - llamastack.io
+  resources:
+  - llamastackdistributions/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/name: llama-stack-k8s-operator