Restrict RBAC permissions

deploy/cluster_role.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ext-postgres-operator
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - '*'
+- apiGroups:
+  - apps
+  resourceNames:
+  - ext-postgres-operator
+  resources:
+  - deployments/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - db.movetokube.com
+  resources:
+  - '*'
+  verbs:
+  - '*'
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - '*'

deploy/cluster_role_binding.yaml

@@ -0,0 +1,11 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ext-postgres-operator
+subjects:
+- kind: ServiceAccount
+  name: ext-postgres-operator
+roleRef:
+  kind: ClusterRole
+  name: ext-postgres-operator
+  apiGroup: rbac.authorization.k8s.io

deploy/kustomization.yaml

@@ -7,6 +7,8 @@ resources:
 - crds/db.movetokube.com_postgres_crd.yaml
 - crds/db.movetokube.com_postgresusers_crd.yaml
 - operator.yaml
+- cluster_role.yaml
+- cluster_role_binding.yaml
 - role.yaml
 - role_binding.yaml
 - service_account.yaml

deploy/role.yaml

@@ -1,40 +1,26 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   name: ext-postgres-operator
 rules:
 - apiGroups:
   - ""
   resources:
-  - pods
-  - services
-  - endpoints
-  - persistentvolumeclaims
-  - events
   - configmaps
   - secrets
+  - services
   verbs:
   - '*'
 - apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resourceNames:
-  - ext-postgres-operator
+  - ""
   resources:
-  - deployments/finalizers
+  - pods
   verbs:
-  - update
+  - 'get'
 - apiGroups:
-  - db.movetokube.com
+  - "apps"
   resources:
-  - '*'
+  - replicasets
+  - deployments
   verbs:
-  - '*'
+  - 'get'

deploy/role_binding.yaml

@@ -1,11 +1,11 @@
-kind: ClusterRoleBinding
+kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: ext-postgres-operator
 subjects:
 - kind: ServiceAccount
   name: ext-postgres-operator
 roleRef:
-  kind: ClusterRole
+  kind: Role
   name: ext-postgres-operator
   apiGroup: rbac.authorization.k8s.io