diff --git a/pkg/rbac/role.go b/pkg/rbac/role.go index 9e0c7a781..abe060b20 100644 --- a/pkg/rbac/role.go +++ b/pkg/rbac/role.go @@ -32,12 +32,6 @@ func OrganizationAdminPolicyRules() []rbacv1.PolicyRule { APIGroups: []string{"rbac.authorization.k8s.io"}, Resources: []string{"rolebindings"}, }, - // Grant permission for TeamRoles - { - Verbs: []string{"get", "list", "watch", "update", "patch", "delete", "create"}, - APIGroups: []string{greenhouseapisv1alpha1.GroupVersion.Group}, - Resources: []string{"teamroles"}, - }, // Grant permission to view Alertmanager and AlertmanagerConfig resources { Verbs: []string{"get", "list", "watch"}, @@ -59,11 +53,11 @@ func OrganizationAdminPolicyRules() []rbacv1.PolicyRule { // OrganizationClusterAdminPolicyRules returns the namespace-scoped PolicyRules for an organization cluster admin. func OrganizationClusterAdminPolicyRules() []rbacv1.PolicyRule { policyRules := []rbacv1.PolicyRule{ - // Grant read permissions for Clusters to organization cluster admins. + // Grant CRUD Permissions for Clusters, TeamRoles and TeamRoleBindings { Verbs: []string{"get", "list", "watch", "update", "patch", "delete", "create"}, APIGroups: []string{greenhouseapisv1alpha1.GroupVersion.Group}, - Resources: []string{"clusters"}, + Resources: []string{"clusters", "teamroles", "teamrolebindings"}, }, // Grant permissions for secrets referenced by other resources, e.g. Plugins for storing sensitive values. // Retrieving these secrets is not permitted to the user. @@ -72,12 +66,6 @@ func OrganizationClusterAdminPolicyRules() []rbacv1.PolicyRule { APIGroups: []string{corev1.GroupName}, Resources: []string{"secrets"}, }, - // Grant permission for TeamRoleBindings - { - Verbs: []string{"get", "list", "watch", "update", "patch", "delete", "create"}, - APIGroups: []string{greenhouseapisv1alpha1.GroupVersion.Group}, - Resources: []string{"teamrolebindings"}, - }, } return append(OrganizationMemberPolicyRules(), policyRules...) } @@ -109,7 +97,7 @@ func OrganizationMemberPolicyRules() []rbacv1.PolicyRule { { Verbs: []string{"get", "list", "watch"}, APIGroups: []string{greenhouseapisv1alpha1.GroupVersion.Group}, - Resources: []string{"clusters", "plugins", "pluginpresets", "teams", "teammemberships"}, + Resources: []string{"clusters", "plugins", "pluginpresets", "teams", "teammemberships", "teamroles", "teamrolebindings"}, }, } }