chore(instrumentor): updated rbac permissions in helm template

odigos-io · Dec 20, 2024 · 2d5c263 · 2d5c263
1 parent 73811c2
commit 2d5c263
Show file tree

Hide file tree

Showing 3 changed files with 86 additions and 53 deletions.
diff --git a/helm/odigos/templates/instrumentor/clusterrole.yaml b/helm/odigos/templates/instrumentor/clusterrole.yaml
@@ -6,102 +6,75 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - namespaces
       - nodes
     verbs:
-      - get
       - list
       - watch
+      - get
   - apiGroups:
-      - apps
+      - ""
     resources:
-      - daemonsets
-      - deployments
-      - statefulsets
+      - namespaces
     verbs:
-      - create
-      - get
       - list
-      - patch
-      - update
       - watch
+      - get
   - apiGroups:
-      - ""
+      - apps
     resources:
-      - configmaps
+      - daemonsets
     verbs:
-      - create
-      - delete
       - get
       - list
-      - patch
-      - update
       - watch
+      - update
+      - patch
   - apiGroups:
       - apps
     resources:
-      - daemonsets/finalizers
-      - deployments/finalizers
-      - statefulsets/finalizers
+      - deployments
     verbs:
+      - get
+      - list
+      - watch
       - update
+      - patch
   - apiGroups:
       - apps
     resources:
-      - daemonsets/status
-      - deployments/status
-      - statefulsets/status
+      - statefulsets
     verbs:
       - get
+      - list
+      - watch
+      - update
+      - patch
   - apiGroups:
       - odigos.io
     resources:
-      - collectorsgroups
       - instrumentedapplications
-      - destinations
     verbs:
-      - create
       - delete
       - get
       - list
-      - patch
-      - update
       - watch
   - apiGroups:
       - odigos.io
     resources:
-      - collectorsgroups/finalizers
-      - instrumentedapplications/finalizers
-      - destinations/finalizers
+      - instrumentedapplications/status
     verbs:
+      - get
+      - patch
       - update
   - apiGroups:
       - odigos.io
     resources:
-      - collectorsgroups/status
-      - instrumentedapplications/status
-      - destinations/status
+      - instrumentationconfigs
     verbs:
+      - create
+      - delete
       - get
+      - list
       - patch
       - update
-  - apiGroups:
-    - odigos.io
-    resources:
-    - instrumentationconfigs
-    verbs:
-    - create
-    - delete
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - odigos.io
-    resources:
-    - instrumentationrules
-    verbs:
-    - get
-    - list
-    - watch
+      - watch
diff --git a/helm/odigos/templates/instrumentor/role.yaml b/helm/odigos/templates/instrumentor/role.yaml
@@ -0,0 +1,48 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: odigos-instrumentor
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups:
+      - ""
+    resourceNames:
+      - odigos-config
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - odigos.io
+    resources:
+      - collectorsgroups
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - odigos.io
+    resources:
+     - collectorsgroups/status
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - odigos.io
+    resources:
+      - destinations
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - odigos.io
+    resources:
+      - instrumentationrules
+    verbs:
+      - get
+      - list
+      - watch
diff --git a/helm/odigos/templates/instrumentor/rolebinding.yaml b/helm/odigos/templates/instrumentor/rolebinding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: odigos-instrumentor
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: odigos-instrumentor
+subjects:
+- kind: ServiceAccount
+  name: odigos-instrumentor