Specific privileges, removed cluster-admin.

cloudflow/templates/02-cloudflow-operator-clusterrole.yaml

@@ -0,0 +1,177 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.cloudflow_operator.name }}
+  labels:
+{{- include "cloudflow.labels" . | indent 4 }}
+
+rules:
+  - apiGroups:
+      - "metrics.k8s.io"
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+
+  # The cloudflow-operator needs to access and manage the Akka Microservices CRD
+  - apiGroups:
+      - "cloudflow.lightbend.com"
+    resources:
+      - cloudflowapplications
+      - cloudflowapplications/status
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - delete
+      - patch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - endpoints
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - watch
+      - update 
+ # The cloudflow-operator needs to access and manage Services to expose endpoints
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - services/status
+    verbs:
+      - list
+      - watch
+      - get
+      - create
+      - delete
+      - patch
+      - update
+  # The cloudflow-operator needs to access Pods to retrieve status updates
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - delete
+      - update
+  # The cloudflow-operator needs to check that the CRDs exist
+  - apiGroups:
+    - "apiextensions.k8s.io"
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - watch
+  # The cloudflow-operator needs to manage secrets
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - watch
+      - list
+      - get
+      - create
+      - delete
+      - patch
+      - update
+  # The cloudflow-operator needs to manage Roles and RoleBindings
+  - apiGroups:
+      - "rbac.authorization.k8s.io"
+    resources:
+      - roles
+      - rolebindings
+    verbs:
+      - get
+      - create
+      - delete
+      - patch
+      - update
+  # The cloudflow-operator needs to access and manage Deployments for deployed Cloudflow applications
+  - apiGroups:
+      - "apps"
+    resources:
+      - deployments
+      - deployments/scale
+      - deployments/status
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - delete
+      - patch
+      - update
+  # The cloudflow-operator needs to create, list, and update Events for notable events in the operator and ConfigMaps (+delete) for Metering State
+  - apiGroups:
+      - ""
+    resources:
+      - events
+      - configmaps
+    verbs:
+      - watch
+      - get
+      - list
+      - create
+      - delete
+      - patch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - create
+      - delete
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - "extensions" 
+    resources:
+      - "deployments"
+    verbs:
+      - get
+  # deprecated flink support:
+  - apiGroups:
+      - "flink.k8s.io"
+    resources:
+      - "flinkapplications" 
+    verbs:       
+      - get
+      - list
+      - create
+      - delete
+      - patch
+      - update
+      - watch
+  # deprecated spark support:
+  - apiGroups: 
+      - "sparkoperator.k8s.io"
+    resources:
+      - "sparkapplications"
+    verbs:       
+      - get
+      - list
+      - create
+      - delete
+      - patch
+      - update
+      - watch
+

cloudflow/templates/02-cloudflow-operator-clusterrolebinding.yaml → cloudflow/templates/03-cloudflow-operator-clusterrolebinding.yaml

@@ -7,8 +7,8 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: cluster-admin
+  name: {{ .Values.cloudflow_operator.name }}
 subjects:
   - kind: ServiceAccount
     name: cloudflow-operator
-    namespace: {{.Release.Namespace}}
+    namespace: {{.Release.Namespace}}