diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 9da6e7a5..4dc0b6b9 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -7,7 +7,6 @@ rules: - apiGroups: - "" resources: - - pods - secrets - services verbs: diff --git a/internal/controller/watcher_controller.go b/internal/controller/watcher_controller.go index ee92a00f..fb329eb4 100644 --- a/internal/controller/watcher_controller.go +++ b/internal/controller/watcher_controller.go @@ -89,7 +89,6 @@ func (r *WatcherReconciler) GetLogger(ctx context.Context) logr.Logger { //+kubebuilder:rbac:groups=rabbitmq.openstack.org,resources=transporturls,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups=keystone.openstack.org,resources=keystoneservices,verbs=get;list;watch;create;update;patch;delete; //+kubebuilder:rbac:groups=keystone.openstack.org,resources=keystoneendpoints,verbs=get;list;watch;create;update;patch;delete; -//+kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch //+kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete; // +kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=get;list;watch;create;update;patch;delete; //+kubebuilder:rbac:groups=route.openshift.io,resources=routes,verbs=get;list;watch;create;update;patch;delete; @@ -683,11 +682,6 @@ func (r *WatcherReconciler) ensureRbac( Resources: []string{"securitycontextconstraints"}, Verbs: []string{"use"}, }, - { - APIGroups: []string{""}, - Resources: []string{"pods"}, - Verbs: []string{"create", "get", "list", "watch", "update", "patch", "delete"}, - }, } rbacResult, err := common_rbac.ReconcileRbac(ctx, h, instance, rbacRules) diff --git a/test/functional/watcher_controller_test.go b/test/functional/watcher_controller_test.go index 18ae3b12..97cb66fc 100644 --- a/test/functional/watcher_controller_test.go +++ b/test/functional/watcher_controller_test.go @@ -163,9 +163,8 @@ var _ = Describe("Watcher controller", func() { corev1.ConditionTrue, ) role := th.GetRole(watcherTest.RoleName) - Expect(role.Rules).To(HaveLen(2)) + Expect(role.Rules).To(HaveLen(1)) Expect(role.Rules[0].Resources).To(Equal([]string{"securitycontextconstraints"})) - Expect(role.Rules[1].Resources).To(Equal([]string{"pods"})) th.ExpectCondition( watcherTest.Instance,