Only patch OLM events RBAC if patch verb is missing

projectsyn · Sep 20, 2024 · af7fcf1 · af7fcf1
1 parent a164ebd
commit af7fcf1
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/component/olm.jsonnet b/component/olm.jsonnet
@@ -202,7 +202,11 @@ local patchManifests = function(file, has_csv)
     file {
       contents+: {
         rules: [
-          if r.apiGroups == [ '' ] && r.resources == [ 'events' ] then
+          if
+            r.apiGroups == [ '' ]
+            && r.resources == [ 'events' ]
+            && !std.member(r.verbs, 'patch')
+          then
             r {
               verbs+: [ 'patch' ],
             }