Use permissions in Azure CredentialsRequest

Instead of requesting the "Contributor" role, request the individual permissions that the operator requires in order to manage DNS records on Azure. This commit resolves NE-1244. https://issues.redhat.com/browse/NE-1244 * manifests/00-ingress-credentials-request.yaml: Replace the "Contributor" role with a list of permissions. * pkg/manifests/bindata.go: Regenerate.
openshift · Jul 20, 2023 · 2a198b1 · 2a198b1
1 parent b4b5f42
commit 2a198b1
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 6 deletions.
diff --git a/manifests/00-ingress-credentials-request.yaml b/manifests/00-ingress-credentials-request.yaml
@@ -49,8 +49,11 @@ spec:
   providerSpec:
     apiVersion: cloudcredential.openshift.io/v1
     kind: AzureProviderSpec
-    roleBindings:
-    - role: Contributor
+    permissions:
+    - Microsoft.Network/dnsZones/A/delete
+    - Microsoft.Network/dnsZones/A/write
+    - Microsoft.Network/privateDnsZones/A/delete
+    - Microsoft.Network/privateDnsZones/A/write
 ---
 apiVersion: cloudcredential.openshift.io/v1
 kind: CredentialsRequest

diff --git a/pkg/manifests/bindata.go b/pkg/manifests/bindata.go