Reduce submariner-operator RBAC permissions

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>

submariner-operator/templates/rbac.yaml

@@ -12,28 +12,38 @@ rules:
   - apiGroups:
       - ""
     resources:
-  - pods
+      # For metrics
       - services
-  - services/finalizers
-  - endpoints
-  - persistentvolumeclaims
-  - events
-  - configmaps
-  - secrets
     verbs:
-  - '*'
+      - get
+      - create
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      # Temporarily needed for network-plugin syncer removal
+      - serviceaccounts
+    resourceNames:
+      - submariner-networkplugin-syncer
+    verbs:
+      - delete
   - apiGroups:
       - apps
     resources:
       - deployments
       - daemonsets
-  - replicasets
-  - statefulsets
     verbs:
-  - '*'
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
   - apiGroups:
       - monitoring.coreos.com
     resources:
+      # Needed for openshift monitoring
       - servicemonitors
     verbs:
       - get
@@ -47,24 +57,29 @@ rules:
     verbs:
       - update
   - apiGroups:
-  - ""
+      - submariner.io
     resources:
-  - pods
+      - brokers
-  verbs:
+      - brokers/status
-  - get
+      - submariners
-- apiGroups:
+      - submariners/status
-  - apps
+      - servicediscoveries
-  resources:
+      - servicediscoveries/status
-  - replicasets
     verbs:
       - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
   - apiGroups:
       - submariner.io
     resources:
-  - '*'
+      - gateways
-  - servicediscoveries
     verbs:
-  - '*'
+      - get
+      - list
+      - watch
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -435,9 +450,10 @@ rules:
       - update
       - delete
       - watch
-  - apiGroups:  # pods, services and nodes are looked up to figure out network settings
+  - apiGroups:
       - ""
     resources:
+      # Needed for network settings discovery
       - pods
       - services
       - nodes
@@ -451,27 +467,20 @@ rules:
       - dnses
     verbs:
       - get
-      - list
-      - watch
       - update
   - apiGroups:
       - config.openshift.io
     resources:
+      # Needed for network settings discovery
       - networks
+    resourceNames:
+      - cluster
     verbs:
       - get
-      - list
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - monitoring.coreos.com
     resources:
+      # Needed for openshift monitoring
       - servicemonitors
     verbs:
       - get
@@ -479,11 +488,21 @@ rules:
   - apiGroups:
       - apps
     resources:
+      # Needed for Flannel CNI discovery
       - daemonsets
     verbs:
-      - get
       - list
-      - watch
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      # Temporarily needed for network-plugin syncer removal
+      - clusterroles
+      - clusterrolebindings
+    resourceNames:
+      - ocp-submariner-networkplugin-syncer
+      - submariner-networkplugin-syncer
+    verbs:
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding