CreateRole create a role with the permissions needed by the instance manager
(opts RoleOptions)
| 49 | |
| 50 | // CreateRole create a role with the permissions needed by the instance manager |
| 51 | func CreateRole(opts RoleOptions) rbacv1.Role { |
| 52 | rules := []rbacv1.PolicyRule{ |
| 53 | { |
| 54 | APIGroups: []string{ |
| 55 | "", |
| 56 | }, |
| 57 | Resources: []string{ |
| 58 | "configmaps", |
| 59 | }, |
| 60 | Verbs: []string{ |
| 61 | "get", |
| 62 | "watch", |
| 63 | }, |
| 64 | ResourceNames: getInvolvedConfigMapNames(opts.Cluster), |
| 65 | }, |
| 66 | { |
| 67 | APIGroups: []string{ |
| 68 | "", |
| 69 | }, |
| 70 | Resources: []string{ |
| 71 | "secrets", |
| 72 | }, |
| 73 | Verbs: []string{ |
| 74 | "get", |
| 75 | "watch", |
| 76 | }, |
| 77 | ResourceNames: getInvolvedSecretNames(opts), |
| 78 | }, |
| 79 | { |
| 80 | APIGroups: []string{ |
| 81 | apiv1.SchemeGroupVersion.Group, |
| 82 | }, |
| 83 | Resources: []string{ |
| 84 | "clusters", |
| 85 | }, |
| 86 | Verbs: []string{ |
| 87 | "get", |
| 88 | "list", |
| 89 | "watch", |
| 90 | }, |
| 91 | ResourceNames: []string{ |
| 92 | opts.Cluster.Name, |
| 93 | }, |
| 94 | }, |
| 95 | { |
| 96 | APIGroups: []string{ |
| 97 | apiv1.SchemeGroupVersion.Group, |
| 98 | }, |
| 99 | Resources: []string{ |
| 100 | "clusters/status", |
| 101 | }, |
| 102 | Verbs: []string{ |
| 103 | "get", |
| 104 | "patch", |
| 105 | "update", |
| 106 | "watch", |
| 107 | }, |
| 108 | ResourceNames: []string{ |
no test coverage detected