From 49a2f64a8ecb0c5e851c8a97db29a15eade59f52 Mon Sep 17 00:00:00 2001
From: Tom Pantelis <tompantelis@gmail.com>
Date: Wed, 1 May 2024 13:20:36 -0400
Subject: [PATCH] Reduce lighthouse-coredns RBAC permissions

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
---
 submariner-operator/templates/rbac.yaml | 24 +++---------------------
 1 file changed, 3 insertions(+), 21 deletions(-)

diff --git a/submariner-operator/templates/rbac.yaml b/submariner-operator/templates/rbac.yaml
index c79a627..7d063ec 100644
--- a/submariner-operator/templates/rbac.yaml
+++ b/submariner-operator/templates/rbac.yaml
@@ -661,34 +661,19 @@ kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:lighthouse-coredns
 rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - namespaces
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-      - update
   - apiGroups:
       - discovery.k8s.io
     resources:
       - endpointslices
     verbs:
-      - create
       - get
       - list
       - watch
-      - update
-      - delete
-      - deletecollection
   - apiGroups:
       - submariner.io
     resources:
-      - "gateways"
-      - "submariners"
+      - gateways
+      - submariners
     verbs:
       - get
       - list
@@ -696,14 +681,11 @@ rules:
   - apiGroups:
       - multicluster.x-k8s.io
     resources:
-      - "*"
+      - serviceimports
     verbs:
-      - create
       - get
       - list
       - watch
-      - update
-      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding