From 1dd343ed7e74e804c4d533e3b9da08ae32a64aa0 Mon Sep 17 00:00:00 2001 From: Travis Nielsen Date: Fri, 22 Apr 2022 10:38:58 -0600 Subject: [PATCH] build: add a placeholder rule to rgw rbac With https://github.com/rook/rook/pull/10108 a placeholder role and role binding were added for the rgw service account so the csv generation would generate the service account. That workaround also requires a rule to be added to the role or else the generation is invalid. Now a rule is added to avoid that issue. In the future we need to remove this role and binding when the operator sdk is updated as explained in https://github.com/rook/rook/issues/10141 Signed-off-by: Travis Nielsen --- deploy/charts/library/templates/_cluster-role.tpl | 9 ++++++++- deploy/examples/common.yaml | 11 +++++++++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/deploy/charts/library/templates/_cluster-role.tpl b/deploy/charts/library/templates/_cluster-role.tpl index 1f23d09ce..d3fa2b049 100644 --- a/deploy/charts/library/templates/_cluster-role.tpl +++ b/deploy/charts/library/templates/_cluster-role.tpl @@ -27,7 +27,14 @@ metadata: namespace: {{ .Release.Namespace }} # namespace:cluster rules: # Placeholder role so the rgw service account will - # be generated in the csv + # be generated in the csv. Remove this role and role binding + # when fixing https://github.com/rook/rook/issues/10141. + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get --- # Aspects of ceph-mgr that operate within the cluster's namespace kind: Role diff --git a/deploy/examples/common.yaml b/deploy/examples/common.yaml index 25c0ccb97..a4615aca1 100644 --- a/deploy/examples/common.yaml +++ b/deploy/examples/common.yaml @@ -1011,8 +1011,15 @@ metadata: name: rook-ceph-rgw namespace: rook-ceph # namespace:cluster rules: -# Placeholder role so the rgw service account will -# be generated in the csv + # Placeholder role so the rgw service account will + # be generated in the csv. Remove this role and role binding + # when fixing https://github.com/rook/rook/issues/10141. + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get --- # Allow the operator to manage resources in its own namespace apiVersion: rbac.authorization.k8s.io/v1