fix missing rbac roles

Signed-off-by: Chengwei Guo <chengweiguo@bytedance.com>

Author: cw-Guo

config/rbac/role.yaml

@@ -7,20 +7,23 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - events
+  - configmaps
+  - pods
   verbs:
-  - list
-  - watch
+  - get
 - apiGroups:
   - ""
   resources:
-  - pods
+  - secrets
   verbs:
+  - create
   - get
+  - list
+  - patch
+  - watch
 - apiGroups:
   - ""
   resources:
-  - secrets
   - serviceaccounts
   - services
   verbs:
@@ -29,7 +32,6 @@ rules:
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - apps
@@ -42,46 +44,50 @@ rules:
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - fluentbit.fluent.io
   resources:
   - clusterfilters
+  - clusterfluentbitconfigs
   - clusterinputs
   - clustermultilineparsers
   - clusteroutputs
   - clusterparsers
+  - filters
+  - fluentbitconfigs
   - multilineparsers
+  - outputs
   - parsers
   verbs:
   - list
   - watch
 - apiGroups:
   - fluentbit.fluent.io
   resources:
-  - clusterfluentbitconfigs
   - collectors
-  - filters
-  - fluentbitconfigs
   - fluentbits
-  - inputs
-  - outputs
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
   - update
   - watch
+- apiGroups:
+  - fluentbit.fluent.io
+  resources:
+  - collectors/finalizers
+  - fluentbits/finalizers
+  verbs:
+  - update
 - apiGroups:
   - fluentd.fluent.io
   resources:
   - clusterfilters
+  - clusterfluentdconfigs
   - clusterinputs
   - clusteroutputs
   - filters
+  - fluentdconfigs
   - inputs
   - outputs
   verbs:
@@ -90,42 +96,47 @@ rules:
 - apiGroups:
   - fluentd.fluent.io
   resources:
-  - clusterfluentdconfigs
-  - fluentdconfigs
+  - clusterfluentdconfigs/status
+  - fluentdconfigs/status
+  - fluentds/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - fluentd.fluent.io
+  resources:
   - fluentds
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
   - fluentd.fluent.io
   resources:
-  - fluentdconfigs/finalizers
   - fluentds/finalizers
   verbs:
   - update
 - apiGroups:
-  - fluentd.fluent.io
+  - rbac.authorization.k8s.io
   resources:
-  - fluentdconfigs/status
-  - fluentds/status
+  - clusterrolebindings
+  - clusterroles
   verbs:
+  - create
   - get
+  - list
   - patch
-  - update
+  - watch
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
-  - clusterrolebindings
-  - clusterroles
   - rolebindings
   - roles
   verbs:
   - create
+  - delete
   - get
   - list
   - patch

controllers/collector_controller.go

@@ -42,11 +42,13 @@ type CollectorReconciler struct {
 	Scheme *runtime.Scheme
 }
 
-// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=fluentbits;fluentbitconfigs;collectors;inputs;filters;outputs,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=create
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=create
+// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=collectors,verbs=get;list;watch;update
+// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=collectors/finalizers,verbs=update
+// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=create;get;list;watch;patch
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=create;get;list;watch;patch
 // +kubebuilder:rbac:groups=core,resources=pods,verbs=get
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to

controllers/fluentbit_controller.go

@@ -46,16 +46,16 @@ type FluentBitReconciler struct {
 	Namespaced           bool
 }
 
-// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=fluentbits;fluentbitconfigs;inputs;filters;outputs,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=create;list;get;watch;patch
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=create;list;get;watch;patch
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=create;list;get;watch;patch
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=create;list;get;watch;patch
+// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=fluentbits,verbs=get;list;watch;update
+// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=fluentbits/finalizers,verbs=update
+// +kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=create;get;list;watch;patch
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=create;get;list;watch;patch
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=create;delete;get;list;watch;patch
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=create;delete;get;list;watch;patch
 // +kubebuilder:rbac:groups=core,resources=pods,verbs=get
-// +kubebuilder:rbac:groups=core,resources=events,verbs=list;watch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.

controllers/fluentbitconfig_controller.go

@@ -166,11 +166,12 @@ func (r *FluentBitConfigReconciler) updateSecretIfNeeded(
 	return nil
 }
 
-// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=clusterfluentbitconfigs,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=fluentbitconfigs,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=clusterfluentbitconfigs,verbs=list;watch
+// +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=fluentbitconfigs,verbs=list;watch
 // +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=clusterinputs;clusterfilters;clusteroutputs;clusterparsers;clustermultilineparsers,verbs=list;watch
 // +kubebuilder:rbac:groups=fluentbit.fluent.io,resources=filters;outputs;parsers;multilineparsers,verbs=list;watch
-// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;patch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.

controllers/fluentd_controller.go

@@ -47,9 +47,13 @@ type FluentdReconciler struct {
 	Scheme *runtime.Scheme
 }
 
-// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentds,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentds,verbs=get;list;watch;update
 // +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentds/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentds/finalizers,verbs=update
+// +kubebuilder:rbac:groups=apps,resources=daemonsets;statefulsets,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get
+// +kubebuilder:rbac:groups=core,resources=serviceaccounts;services,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings,verbs=create;get;list;watch;patch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.

controllers/fluentdconfig_controller.go

@@ -82,14 +82,12 @@ type FluentdConfigReconciler struct {
 	Scheme *runtime.Scheme
 }
 
-// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentdconfigs,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=clusterfluentdconfigs,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentdconfigs,verbs=list;watch
+// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=clusterfluentdconfigs,verbs=list;watch
 // +kubebuilder:rbac:groups=fluentd.fluent.io,resources=inputs;filters;outputs,verbs=list;watch
 // +kubebuilder:rbac:groups=fluentd.fluent.io,resources=clusterinputs;clusterfilters;clusteroutputs,verbs=list;watch
 // +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentds,verbs=list
-// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentds/status,verbs=patch
-// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentdconfigs/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=fluentdconfigs/finalizers,verbs=update
+// +kubebuilder:rbac:groups=fluentd.fluent.io,resources=clusterfluentdconfigs/status;fluentdconfigs/status;fluentds/status,verbs=get;update;patch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.