Update RBAC policies for helm chart

charts/ext-postgres-operator/templates/clusterrole.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "chart.fullname" . }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - "*"
+  - apiGroups:
+      - apps
+    resourceNames:
+      - ext-postgres-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - db.movetokube.com
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - "*"

charts/ext-postgres-operator/templates/clusterrole_binding.yaml

@@ -0,0 +1,14 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "chart.fullname" . }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "chart.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "chart.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io

charts/ext-postgres-operator/templates/role.yaml

@@ -1,42 +1,28 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   name: {{ include "chart.fullname" . }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - services
-  - endpoints
-  - persistentvolumeclaims
-  - events
-  - configmaps
-  - secrets
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resourceNames:
-  - ext-postgres-operator
-  resources:
-  - deployments/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - db.movetokube.com
-  resources:
-  - '*'
-  verbs:
-  - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - secrets
+      - services
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - "get"
+  - apiGroups:
+      - "apps"
+    resources:
+      - replicasets
+      - deployments
+    verbs:
+      - "get"

charts/ext-postgres-operator/templates/role_binding.yaml

@@ -1,4 +1,4 @@
-kind: ClusterRoleBinding
+kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "chart.fullname" . }}
@@ -9,6 +9,6 @@ subjects:
   name: {{ include "chart.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 roleRef:
-  kind: ClusterRole
-  name: {{ include "chart.serviceAccountName" . }}
+  kind: Role
+  name: {{ include "chart.fullname" . }}
   apiGroup: rbac.authorization.k8s.io

deploy/cluster_role.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ext-postgres-operator
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - "*"
+  - apiGroups:
+      - apps
+    resourceNames:
+      - ext-postgres-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - db.movetokube.com
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - "*"

deploy/cluster_role_binding.yaml

@@ -0,0 +1,11 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ext-postgres-operator
+subjects:
+  - kind: ServiceAccount
+    name: ext-postgres-operator
+roleRef:
+  kind: ClusterRole
+  name: ext-postgres-operator
+  apiGroup: rbac.authorization.k8s.io

deploy/kustomization.yaml

@@ -4,9 +4,11 @@ kind: Kustomization
 namespace: operators
 
 resources:
-- crds/db.movetokube.com_postgres_crd.yaml
-- crds/db.movetokube.com_postgresusers_crd.yaml
-- operator.yaml
-- role.yaml
-- role_binding.yaml
-- service_account.yaml
+  - crds/db.movetokube.com_postgres_crd.yaml
+  - crds/db.movetokube.com_postgresusers_crd.yaml
+  - operator.yaml
+  - cluster_role.yaml
+  - cluster_role_binding.yaml
+  - role.yaml
+  - role_binding.yaml
+  - service_account.yaml

deploy/role.yaml

@@ -1,40 +1,26 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   name: ext-postgres-operator
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - services
-  - endpoints
-  - persistentvolumeclaims
-  - events
-  - configmaps
-  - secrets
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resourceNames:
-  - ext-postgres-operator
-  resources:
-  - deployments/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - db.movetokube.com
-  resources:
-  - '*'
-  verbs:
-  - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - secrets
+      - services
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - "get"
+  - apiGroups:
+      - "apps"
+    resources:
+      - replicasets
+      - deployments
+    verbs:
+      - "get"

deploy/role_binding.yaml

@@ -1,11 +1,11 @@
-kind: ClusterRoleBinding
+kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: ext-postgres-operator
 subjects:
-- kind: ServiceAccount
-  name: ext-postgres-operator
+  - kind: ServiceAccount
+    name: ext-postgres-operator
 roleRef:
-  kind: ClusterRole
+  kind: Role
   name: ext-postgres-operator
   apiGroup: rbac.authorization.k8s.io