[RBAC] Remove unnecessary permissions from the gpu-operator app

Signed-off-by: Tariq Ibrahim <[email protected]>
NVIDIA · Jun 6, 2024 · bc400b4 · bc400b4
1 parent 91f65cb
commit bc400b4
Show file tree

Hide file tree

Showing 2 changed files with 52 additions and 13 deletions.
diff --git a/deployments/gpu-operator/templates/role.yaml → ...s/gpu-operator/templates/clusterrole.yaml b/deployments/gpu-operator/templates/role.yaml → ...s/gpu-operator/templates/clusterrole.yaml
@@ -20,21 +20,40 @@ rules:
   - clusterroles
   - clusterrolebindings
   verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
 - apiGroups:
   - ""
   resources:
   - pods
   - services
-  - endpoints
-  - persistentvolumeclaims
   - events
   - configmaps
   - secrets
   - serviceaccounts
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
   - nodes
   verbs:
-  - '*'
+  - get
+  - list
+  - watch
+  - update
+  - patch
 - apiGroups:
   - ""
   resources:
@@ -51,18 +70,22 @@ rules:
   resources:
   - deployments
   - daemonsets
-  - replicasets
-  - statefulsets
   verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
 - apiGroups:
   - apps
   resources:
   - controllerrevisions
   verbs:
-  - 'get'
-  - 'list'
-  - 'watch'
+  - get
+  - list
+  - watch
 - apiGroups:
   - monitoring.coreos.com
   resources:
@@ -78,9 +101,19 @@ rules:
 - apiGroups:
   - nvidia.com
   resources:
-  - '*'
+  - clusterpolicies
+  - clusterpolicies/status
+  - nvidiadrivers
+  - nvidiadrivers/status
   verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+  - deletecollection
 - apiGroups:
   - scheduling.k8s.io
   resources:
@@ -95,7 +128,13 @@ rules:
   resources:
   - securitycontextconstraints
   verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
 - apiGroups:
   - config.openshift.io
   resources:

diff --git a/...s/gpu-operator/templates/rolebinding.yaml → ...perator/templates/clusterrolebinding.yaml b/...s/gpu-operator/templates/rolebinding.yaml → ...perator/templates/clusterrolebinding.yaml