refactor: remove DaemonSet update and patch permission

GoogleCloudPlatform · Aug 23, 2024 · a1bac79 · a1bac79
1 parent 35aa555
commit a1bac79
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 14 deletions.
diff --git a/charts/operator/templates/role.yaml b/charts/operator/templates/role.yaml
@@ -78,7 +78,7 @@ rules:
   - daemonsets
   apiGroups: ["apps"]
   resourceNames: ["collector"]
-  verbs: ["get", "list", "watch", "patch", "update"]
+  verbs: ["get", "list", "watch"]
 - resources:
   - deployments
   apiGroups: ["apps"]

diff --git a/manifests/operator.yaml b/manifests/operator.yaml
@@ -204,7 +204,7 @@ rules:
   - daemonsets
   apiGroups: ["apps"]
   resourceNames: ["collector"]
-  verbs: ["get", "list", "watch", "patch", "update"]
+  verbs: ["get", "list", "watch"]
 - resources:
   - deployments
   apiGroups: ["apps"]

diff --git a/pkg/operator/collection.go b/pkg/operator/collection.go
@@ -229,18 +229,7 @@ func (r *collectionReconciler) ensureCollectorDaemonSet(ctx context.Context) err
 		logger.Error(err, "collector DaemonSet does not exist")
 		return nil
 	}
-	if err != nil {
-		return err
-	}
-
-	setContainerExtraArgs(ds.Spec.Template.Spec.Containers, CollectorPrometheusContainerName, "")
-
-	// Support not having UPDATE permission. We will remove it in the future.
-	// See: https://github.com/GoogleCloudPlatform/prometheus-engine/pull/1079
-	if err := r.client.Update(ctx, &ds); !apierrors.IsForbidden(err) {
-		return err
-	}
-	return nil
+	return err
 }
 
 func gzipData(data []byte) ([]byte, error) {