Merge pull request #380 from vshn/fix379

Add missing finalizer RBAC rules

config/rbac/role.yaml

@@ -33,6 +33,7 @@ rules:
 - apiGroups:
   - backup.appuio.ch
   resources:
+  - archives/finalizers
   - archives/status
   verbs:
   - get
@@ -53,6 +54,7 @@ rules:
 - apiGroups:
   - backup.appuio.ch
   resources:
+  - backups/finalizers
   - backups/status
   verbs:
   - get
@@ -73,6 +75,7 @@ rules:
 - apiGroups:
   - backup.appuio.ch
   resources:
+  - checks/finalizers
   - checks/status
   verbs:
   - get
@@ -111,6 +114,7 @@ rules:
 - apiGroups:
   - backup.appuio.ch
   resources:
+  - prebackuppods/finalizers
   - prebackuppods/status
   verbs:
   - get
@@ -131,6 +135,7 @@ rules:
 - apiGroups:
   - backup.appuio.ch
   resources:
+  - prunes/finalizers
   - prunes/status
   verbs:
   - get
@@ -151,6 +156,7 @@ rules:
 - apiGroups:
   - backup.appuio.ch
   resources:
+  - restores/finalizers
   - restores/status
   verbs:
   - get
@@ -171,6 +177,7 @@ rules:
 - apiGroups:
   - backup.appuio.ch
   resources:
+  - schedules/finalizers
   - schedules/status
   verbs:
   - get
@@ -191,6 +198,7 @@ rules:
 - apiGroups:
   - batch
   resources:
+  - jobs/finalizers
   - jobs/status
   verbs:
   - get

controllers/archive_controller.go

@@ -25,7 +25,7 @@ type ArchiveReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=archives,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=backup.appuio.ch,resources=archives/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=backup.appuio.ch,resources=archives/status;archives/finalizers,verbs=get;update;patch
 
 // Reconcile is the entrypoint to manage the given resource.
 func (r *ArchiveReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {

controllers/backup_controller.go

@@ -25,9 +25,9 @@ type BackupReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=backups,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=backup.appuio.ch,resources=backups/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=backup.appuio.ch,resources=backups/status;backups/finalizers,verbs=get;update;patch
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=prebackuppods,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=backup.appuio.ch,resources=prebackuppods/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=backup.appuio.ch,resources=prebackuppods/status;prebackuppods/finalizers,verbs=get;update;patch
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=core,resources=pods,verbs="*"

controllers/check_controller.go

@@ -25,7 +25,7 @@ type CheckReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=checks,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=backup.appuio.ch,resources=checks/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=backup.appuio.ch,resources=checks/status;checks/finalizers,verbs=get;update;patch
 
 // Reconcile is the entrypoint to manage the given resource.
 func (r *CheckReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {

controllers/job_controller.go

@@ -22,7 +22,7 @@ type JobReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=batch,resources=jobs/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=batch,resources=jobs/status;jobs/finalizers,verbs=get;update;patch
 
 // Reconcile is the entrypoint to manage the given resource.
 func (r *JobReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {

controllers/prune_controller.go

@@ -25,7 +25,7 @@ type PruneReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=prunes,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=backup.appuio.ch,resources=prunes/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=backup.appuio.ch,resources=prunes/status;prunes/finalizers,verbs=get;update;patch
 
 // Reconcile is the entrypoint to manage the given resource.
 func (r *PruneReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {

controllers/restore_controller.go

@@ -25,7 +25,7 @@ type RestoreReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=restores,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=backup.appuio.ch,resources=restores/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=backup.appuio.ch,resources=restores/status;restores/finalizers,verbs=get;update;patch
 
 // Reconcile is the entrypoint to manage the given resource.
 func (r *RestoreReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {

controllers/schedule_controller.go

@@ -26,7 +26,7 @@ type ScheduleReconciler struct {
 }
 
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=schedules,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=backup.appuio.ch,resources=schedules/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=backup.appuio.ch,resources=schedules/status;schedules/finalizers,verbs=get;update;patch
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=effectiveschedules,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=backup.appuio.ch,resources=effectiveschedules/finalizers,verbs=update