From 33a1f47a537ebb9b032d0602e95f869a13b72242 Mon Sep 17 00:00:00 2001 From: Francesco Ilario Date: Wed, 17 Apr 2024 11:02:38 +0200 Subject: [PATCH] fix viewer role permissions Signed-off-by: Francesco Ilario --- .../appstudio/spacerole_viewer.yaml | 27 -- .../appstudio/spacerole_viewer.yaml | 269 ++++++++++-------- 2 files changed, 146 insertions(+), 150 deletions(-) diff --git a/deploy/templates/nstemplatetiers/appstudio/spacerole_viewer.yaml b/deploy/templates/nstemplatetiers/appstudio/spacerole_viewer.yaml index 4092a2402..e743a5cd9 100644 --- a/deploy/templates/nstemplatetiers/appstudio/spacerole_viewer.yaml +++ b/deploy/templates/nstemplatetiers/appstudio/spacerole_viewer.yaml @@ -22,9 +22,6 @@ objects: - get - list - watch - - create - - update - - patch - apiGroups: - appstudio.redhat.com resources: @@ -81,10 +78,6 @@ objects: - get - list - watch - - create - - update - - patch - - delete - apiGroups: - appstudio.redhat.com resources: @@ -103,10 +96,6 @@ objects: - get - list - watch - - create - - update - - patch - - delete - apiGroups: - appstudio.redhat.com resources: @@ -115,10 +104,6 @@ objects: - get - list - watch - - create - - update - - patch - - delete - apiGroups: - jvmbuildservice.io resources: @@ -128,9 +113,6 @@ objects: - get - list - watch - - create - - update - - patch - apiGroups: - appstudio.redhat.com resources: @@ -138,14 +120,10 @@ objects: - spiaccesschecks - spiaccesstokens - spifilecontentrequests - - spiaccesstokendataupdates verbs: - get - list - watch - - create - - update - - patch - apiGroups: - appstudio.redhat.com resources: @@ -170,7 +148,6 @@ objects: - get - list - watch - # Allow using the project-controller - apiGroups: - projctl.konflux.dev resources: @@ -181,10 +158,6 @@ objects: - get - list - watch - - create - - update - - patch - - delete - apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: diff --git a/test/templates/nstemplatetiers/appstudio/spacerole_viewer.yaml b/test/templates/nstemplatetiers/appstudio/spacerole_viewer.yaml index c351ea032..c3cd9bf80 100644 --- a/test/templates/nstemplatetiers/appstudio/spacerole_viewer.yaml +++ b/test/templates/nstemplatetiers/appstudio/spacerole_viewer.yaml @@ -19,129 +19,152 @@ objects: namespace: ${NAMESPACE} name: appstudio-viewer-user-actions rules: - - apiGroups: - - appstudio.redhat.com - resources: - - applications - - components - - componentdetectionqueries - verbs: - - get - - list - - watch - - create - - update - - patch - - apiGroups: - - appstudio.redhat.com - resources: - - promotionruns - - snapshotenvironmentbindings - - snapshots - - environments - verbs: - - get - - list - - watch - - apiGroups: - - appstudio.redhat.com - resources: - - deploymentttargets - - deploymenttargetclaims - verbs: - - get - - list - - watch - - apiGroups: - - managed-gitops.redhat.com - resources: - - gitopsdeployments - - gitopsdeploymentmanagedenvironments - - gitopsdeploymentrepositorycredentials - - gitopsdeploymentsyncruns - verbs: - - get - - list - - watch - - apiGroups: - - tekton.dev - resources: - - pipelineruns - verbs: - - get - - list - - watch - - apiGroups: - - results.tekton.dev - resources: - - results - - records - verbs: - - get - - list - - apiGroups: - - appstudio.redhat.com - resources: - - integrationtestscenarios - verbs: - - '*' - - apiGroups: - - appstudio.redhat.com - resources: - - enterprisecontractpolicies - verbs: - - get - - list - - watch - - apiGroups: - - appstudio.redhat.com - resources: - - releases - - releasestrategies - - releaseplans - verbs: - - '*' - - apiGroups: - - appstudio.redhat.com - resources: - - releaseplanadmissions - verbs: - - '*' - - apiGroups: - - jvmbuildservice.io - resources: - - jbsconfigs - - artifactbuilds - verbs: - - get - - list - - watch - - create - - update - - patch - - apiGroups: - - appstudio.redhat.com - resources: - - spiaccesstokenbindings - - spiaccesschecks - - spiaccesstokens - - spifilecontentrequests - - spiaccesstokendataupdates - verbs: - - get - - list - - watch - - create - - update - - patch - - apiGroups: - - '' - resources: - - configmaps - verbs: - - get - - list - - watch + - apiGroups: + - appstudio.redhat.com + resources: + - applications + - components + - componentdetectionqueries + verbs: + - get + - list + - watch + - apiGroups: + - appstudio.redhat.com + resources: + - promotionruns + - snapshotenvironmentbindings + - snapshots + - environments + verbs: + - get + - list + - watch + - apiGroups: + - appstudio.redhat.com + resources: + - deploymenttargets + - deploymenttargetclaims + verbs: + - get + - list + - watch + - apiGroups: + - managed-gitops.redhat.com + resources: + - gitopsdeployments + - gitopsdeploymentmanagedenvironments + - gitopsdeploymentrepositorycredentials + - gitopsdeploymentsyncruns + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + verbs: + - get + - list + - watch + - apiGroups: + - results.tekton.dev + resources: + - results + - records + - logs + verbs: + - get + - list + - apiGroups: + - appstudio.redhat.com + resources: + - integrationtestscenarios + verbs: + - get + - list + - watch + - apiGroups: + - appstudio.redhat.com + resources: + - enterprisecontractpolicies + verbs: + - get + - list + - watch + - apiGroups: + - appstudio.redhat.com + resources: + - releases + - releasestrategies + - releaseplans + verbs: + - get + - list + - watch + - apiGroups: + - appstudio.redhat.com + resources: + - releaseplanadmissions + verbs: + - get + - list + - watch + - apiGroups: + - jvmbuildservice.io + resources: + - jbsconfigs + - artifactbuilds + verbs: + - get + - list + - watch + - apiGroups: + - appstudio.redhat.com + resources: + - spiaccesstokenbindings + - spiaccesschecks + - spiaccesstokens + - spifilecontentrequests + verbs: + - get + - list + - watch + - apiGroups: + - appstudio.redhat.com + resources: + - remotesecrets + verbs: + - get + - list + - watch + - apiGroups: + - '' + resources: + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - appstudio.redhat.com + resources: + - buildpipelineselectors + verbs: + - get + - list + - watch + - apiGroups: + - projctl.konflux.dev + resources: + - projects + - projectdevelopmentstreams + - projectdevelopmentstreamtemplates + verbs: + - get + - list + - watch - apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: