Add permissions for clusterlifecycle state metrics (#1175)

Signed-off-by: zhujian <[email protected]>
stolostron · Jan 6, 2025 · dd198ce · dd198ce
1 parent 029beee
commit dd198ce
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 1 deletion.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -182,6 +182,7 @@ rules:
   - events
   verbs:
   - create
+  - delete
   - get
   - list
   - patch

diff --git a/pkg/templates/charts/toggle/cluster-lifecycle/templates/metrics-clusterrole.yaml b/pkg/templates/charts/toggle/cluster-lifecycle/templates/metrics-clusterrole.yaml
@@ -51,5 +51,15 @@ rules:
 - apiGroups: ["work.open-cluster-management.io"]
   resources: ["manifestworks"]
   verbs: ["get","list","watch"]
+# Allow hub to patch manifestwroks annotation
+- apiGroups: ["work.open-cluster-management.io"]
+  resources: ["manifestworks"]
+  verbs: ["patch"]
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get","create","update","patch","delete"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["get","create","update","patch","delete"]
 - nonResourceURLs: ["/metrics"]
-  verbs: ["get"]
+  verbs: ["get"]
diff --git a/pkg/templates/rbac_gen.go b/pkg/templates/rbac_gen.go
-Original file line number
+Diff line change
@@ Expand Up / @@ -182,6 +182,7 @@ rules: @@
       - events
       verbs:
       - create
+      - delete
       - get
       - list
       - patch
@@ Expand Down @@