From 66dba4fd411ffd7be4c7f3a3fbc5715ffc8ebf2c Mon Sep 17 00:00:00 2001
From: Travis Nielsen <tnielsen@redhat.com>
Date: Fri, 11 Jun 2021 16:45:51 -0600
Subject: [PATCH] ceph: add rbac for mgr to create service monitor

When there are two mgr daemons, a sidecar of the mgr will update the
service monitor depending on the active mgr daemon. When there is only
a single mgr, the operator will create the service monitor. Now, we
add rbac for the mgr to create these resources.

Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
---
 .../kubernetes/ceph/monitoring/rbac.yaml      | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/cluster/examples/kubernetes/ceph/monitoring/rbac.yaml b/cluster/examples/kubernetes/ceph/monitoring/rbac.yaml
index 0a9d80537..97c86d4e7 100644
--- a/cluster/examples/kubernetes/ceph/monitoring/rbac.yaml
+++ b/cluster/examples/kubernetes/ceph/monitoring/rbac.yaml
@@ -70,3 +70,39 @@ subjects:
   namespace: rook-ceph
 # OLM: END ROLE BINDING
 ---
+# OLM: BEGIN ROLE
+# Allow management of monitoring resources in the mgr
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rook-ceph-monitor-mgr
+  namespace: rook-ceph
+rules:
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - get
+  - list
+  - create
+  - update
+# OLM: END ROLE
+---
+# OLM: BEGIN ROLE BINDING
+# Allow creation of monitoring resources in the mgr
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rook-ceph-monitor-mgr
+  namespace: rook-ceph
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: rook-ceph-monitor-mgr
+subjects:
+- kind: ServiceAccount
+  name: rook-ceph-mgr
+  namespace: rook-ceph
+# OLM: END ROLE BINDING
+---