fix rbac of dashboard

Signed-off-by: zwwhdls <[email protected]>
juicedata · Sep 18, 2024 · 8390bd4 · 8390bd4
1 parent 4854ef8
commit 8390bd4
Show file tree

Hide file tree

Showing 6 changed files with 63 additions and 7 deletions.
diff --git a/deploy/k8s.yaml b/deploy/k8s.yaml
@@ -41,7 +41,6 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
   - persistentvolumes
   - persistentvolumeclaims
   - persistentvolumeclaims/status
@@ -50,6 +49,15 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - update
 - apiGroups:
   - storage.k8s.io
   resources:

diff --git a/deploy/k8s_before_v1_18.yaml b/deploy/k8s_before_v1_18.yaml
@@ -41,7 +41,6 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
   - persistentvolumes
   - persistentvolumeclaims
   - persistentvolumeclaims/status
@@ -50,6 +49,15 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - update
 - apiGroups:
   - storage.k8s.io
   resources:

diff --git a/deploy/kubernetes/base/resources.yaml b/deploy/kubernetes/base/resources.yaml
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - pods
       - persistentvolumes
       - persistentvolumeclaims
       - persistentvolumeclaims/status
@@ -222,6 +221,15 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+      - update
   - apiGroups:
       - storage.k8s.io
     resources:

diff --git a/deploy/webhook-with-certmanager.yaml b/deploy/webhook-with-certmanager.yaml
@@ -31,7 +31,6 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
   - persistentvolumes
   - persistentvolumeclaims
   - persistentvolumeclaims/status
@@ -40,6 +39,15 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - update
 - apiGroups:
   - storage.k8s.io
   resources:

diff --git a/deploy/webhook.yaml b/deploy/webhook.yaml
@@ -31,7 +31,6 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
   - persistentvolumes
   - persistentvolumeclaims
   - persistentvolumeclaims/status
@@ -40,6 +39,15 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - update
 - apiGroups:
   - storage.k8s.io
   resources:

diff --git a/scripts/juicefs-csi-webhook-install.sh b/scripts/juicefs-csi-webhook-install.sh
@@ -102,7 +102,6 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
   - persistentvolumes
   - persistentvolumeclaims
   - persistentvolumeclaims/status
@@ -111,6 +110,15 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - update
 - apiGroups:
   - storage.k8s.io
   resources:
@@ -846,7 +854,6 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
   - persistentvolumes
   - persistentvolumeclaims
   - persistentvolumeclaims/status
@@ -855,6 +862,15 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - update
 - apiGroups:
   - storage.k8s.io
   resources: