kube124: Adds new clusterRole for Upsyncer

kcp-dev · Nov 29, 2022 · 0c98074 · 0c98074
1 parent 067006c
commit 0c98074
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/config/rootcompute/kube-1.24/bootstrap.go b/config/rootcompute/kube-1.24/bootstrap.go
@@ -27,6 +27,11 @@ import (
 	confighelpers "github.com/kcp-dev/kcp/config/helpers"
 )
 
+const (
+	// UpsyncedClusterRoleName is the name of the ClusterRole that is used to grant permissions for upsyncing to syncers.
+	UpsyncedClusterRoleName = "compute:apiexport:kubernetes:upsynced-permission-policy"
+)
+
 //go:embed *.yaml
 var KubeComputeFS embed.FS
 

diff --git a/config/rootcompute/kube-1.24/clusterrole-kubernetes-upsynced-permission-policy.yaml b/config/rootcompute/kube-1.24/clusterrole-kubernetes-upsynced-permission-policy.yaml
@@ -0,0 +1,8 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: compute:apiexport:kubernetes:upsynced-permission-policy
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "pods/status"]
+    verbs: ["*"]