Reduce lighthouse-agent RBAC permissions

Signed-off-by: Tom Pantelis <[email protected]>
submariner-io · May 6, 2024 · 1b251e8 · 1b251e8
1 parent f037f15
commit 1b251e8
Showing 1 changed file with 18 additions and 4 deletions.
diff --git a/submariner-operator/templates/rbac.yaml b/submariner-operator/templates/rbac.yaml
@@ -615,7 +615,6 @@ rules:
       - get
       - list
       - watch
-      - update
   - apiGroups:
       - discovery.k8s.io
     resources:
@@ -632,23 +631,38 @@ rules:
   - apiGroups:
       - submariner.io
     resources:
-      - "gateways"
-      - "globalingressips"
+      - gateways
+      - globalingressips
     verbs:
       - get
       - list
       - watch
   - apiGroups:
       - multicluster.x-k8s.io
     resources:
-      - "*"
+      - serviceimports
+      - serviceimports/status
     verbs:
       - create
       - get
       - list
       - watch
       - update
       - delete
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - serviceexports
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - serviceexports/status
+    verbs:
+      - update
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding