Add explicit RBAC permissions for finalizers subresources

kubernetes · Mar 3, 2021 · c60088d · c60088d
1 parent e31b329
commit c60088d
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 0 deletions.
diff --git a/upup/models/bindata.go b/upup/models/bindata.go
diff --git a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.8.yaml.template b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.8.yaml.template
@@ -237,6 +237,16 @@ rules:
   - ""
   resources:
   - pods
+  - pods/finalizers
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - delete
+- apiGroups:
+  - ""
+  resources:
   - nodes
   verbs:
   - get
@@ -273,12 +283,16 @@ rules:
   - cilium.io
   resources:
   - ciliumnetworkpolicies
+  - ciliumnetworkpolicies/finalizers
   - ciliumnetworkpolicies/status
   - ciliumclusterwidenetworkpolicies
+  - ciliumclusterwidenetworkpolicies/finalizers
   - ciliumclusterwidenetworkpolicies/status
   - ciliumendpoints
+  - ciliumendpoints/finalizers
   - ciliumendpoints/status
   - ciliumnodes
+  - ciliumnodes/finalizers
   - ciliumnodes/status
   - ciliumidentities
   verbs:
@@ -330,14 +344,19 @@ rules:
   - cilium.io
   resources:
   - ciliumnetworkpolicies
+  - ciliumnetworkpolicies/finalizers
   - ciliumnetworkpolicies/status
   - ciliumclusterwidenetworkpolicies
+  - ciliumclusterwidenetworkpolicies/finalizers
   - ciliumclusterwidenetworkpolicies/status
   - ciliumendpoints
+  - ciliumendpoints/finalizers
   - ciliumendpoints/status
   - ciliumnodes
+  - ciliumnodes/finalizers
   - ciliumnodes/status
   - ciliumidentities
+  - ciliumidentities/finalizers
   - ciliumidentities/status
   verbs:
   - '*'