add rbac permission for configmap

Signed-off-by: Adem Baccara <71262172+Adembc@users.noreply.github.com>
kubeflow · Jul 6, 2024 · 79970d8 · 79970d8
1 parent 08bd18e
commit 79970d8
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/workspaces/controller/config/rbac/role.yaml b/workspaces/controller/config/rbac/role.yaml
@@ -12,8 +12,24 @@ rules:
   - create
   - delete
   - get
+  - list
   - patch
   - update
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -22,6 +38,7 @@ rules:
   - create
   - delete
   - get
+  - list
   - patch
   - update
 - apiGroups:

diff --git a/workspaces/controller/internal/controller/workspace_controller.go b/workspaces/controller/internal/controller/workspace_controller.go
@@ -75,8 +75,10 @@ type WorkspaceReconciler struct {
 //+kubebuilder:rbac:groups=kubeflow.org,resources=workspacekinds,verbs=list;watch
 //+kubebuilder:rbac:groups=kubeflow.org,resources=workspaces/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=kubeflow.org,resources=workspaces/finalizers,verbs=update
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;update;patch;create;delete
-// +kubebuilder:rbac:groups=core,resources=services,verbs=get;update;patch;create;delete
+// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=list;get;update;patch;create;delete
+// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch
+// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list
+// +kubebuilder:rbac:groups=core,resources=services,verbs=list;get;update;patch;create;delete
 // +kubebuilder:rbac:groups="networking.istio.io",resources=virtualservices,verbs=get;update;patch;create;delete
 
 func (r *WorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {