Fix tenant without clusters allowed access to all clusters (#274)

Follow up of the cleanup in #272 .
projectsyn · Jun 4, 2024 · a5dd7bf · a5dd7bf
1 parent 3cd83e6
commit a5dd7bf
Showing 1 changed file with 15 additions and 12 deletions.
diff --git a/controllers/tenant/role.go b/controllers/tenant/role.go
@@ -44,18 +44,21 @@ func reconcileRole(obj pipeline.Object, data *pipeline.Context) pipeline.Result
 				Resources:     []string{"tenants"},
 				ResourceNames: []string{tenant.Name},
 			},
-			{
-				APIGroups:     []string{synv1alpha1.GroupVersion.Group},
-				Verbs:         []string{"get"},
-				Resources:     []string{"clusters"},
-				ResourceNames: clusterNames,
-			},
-			{
-				APIGroups:     []string{synv1alpha1.GroupVersion.Group},
-				Verbs:         []string{"get", "update", "patch"},
-				Resources:     []string{"clusters/status"},
-				ResourceNames: clusterNames,
-			},
+		}
+		if len(clusterNames) > 0 {
+			role.Rules = append(role.Rules,
+				rbacv1.PolicyRule{
+					APIGroups:     []string{synv1alpha1.GroupVersion.Group},
+					Verbs:         []string{"get"},
+					Resources:     []string{"clusters"},
+					ResourceNames: clusterNames,
+				},
+				rbacv1.PolicyRule{
+					APIGroups:     []string{synv1alpha1.GroupVersion.Group},
+					Verbs:         []string{"get", "update", "patch"},
+					Resources:     []string{"clusters/status"},
+					ResourceNames: clusterNames,
+				})
 		}
 		return controllerutil.SetControllerReference(tenant, &role, data.Client.Scheme())
 	})