From 19755ab341dbae9c0ea88a6f2ff2eb83936d4539 Mon Sep 17 00:00:00 2001 From: Yftach Herzog Date: Mon, 7 Oct 2024 11:50:59 +0300 Subject: [PATCH] docs(KFLUXVNGD-38): update project permissions Maintainers should not have delete permissions on Project* resources as they should not be allowed to delete applications or components. Signed-off-by: Yftach Herzog --- ADR/0011-roles-and-permissions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ADR/0011-roles-and-permissions.md b/ADR/0011-roles-and-permissions.md index f887d066..3e4d5a44 100644 --- a/ADR/0011-roles-and-permissions.md +++ b/ADR/0011-roles-and-permissions.md @@ -61,7 +61,7 @@ We will use the built-in Kubernetes RBAC system for Konflux's role and permissio | | *Service Access* | appstudio.redhat.com | get, list, watch, create, update, patch | spiaccesstokenbindings, spiaccesschecks, spiaccesstokens, spifilecontentrequests, spiaccesstokendataupdates | | *Remote Secrets* | appstudio.redhat.com | get, list, watch | remotesecrets | | Build Service | appstudio.redhat.com | get, list, watch, create | buildpipelineselectors -| | Project Controller | projctl.konflux.dev | get, list, watch, create, update, patch, delete | projects, projectdevelopmentstreams, projectdevelopmentstreamtemplates +| | Project Controller | projctl.konflux.dev | get, list, watch, create, update, patch | projects, projectdevelopmentstreams, projectdevelopmentstreamtemplates | | *Configs* | | get, list, watch | configmaps | | *Secrets* | | | secrets | | Add User |