From 8df47c6f85ed61a5eee6d82e97f795f980320480 Mon Sep 17 00:00:00 2001
From: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
Date: Thu, 6 Aug 2020 00:45:43 +0530
Subject: [PATCH] Add roles for endpoints and endpointslices

* Add clusterrole to give lighthouse serviceaccount access to endpoints and
endpointslices
* Add role to give broker serviceaccont access to endpoint slices

Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
---
 submariner-k8s-broker/templates/rbac.yaml | 3 +++
 submariner/templates/rbac.yaml            | 5 ++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/submariner-k8s-broker/templates/rbac.yaml b/submariner-k8s-broker/templates/rbac.yaml
index ae1c72b..65940c0 100644
--- a/submariner-k8s-broker/templates/rbac.yaml
+++ b/submariner-k8s-broker/templates/rbac.yaml
@@ -15,6 +15,9 @@ rules:
 - apiGroups: ["lighthouse.submariner.io"]
   resources: ["*"]
   verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["discovery.k8s.io"]
+  resources: ["endpointslices"]
+  verbs: ["create", "get", "list", "watch","patch", "update", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
diff --git a/submariner/templates/rbac.yaml b/submariner/templates/rbac.yaml
index 684bb38..f3f38ed 100644
--- a/submariner/templates/rbac.yaml
+++ b/submariner/templates/rbac.yaml
@@ -118,8 +118,11 @@ metadata:
   name: {{ template "submariner.fullname" . }}:lighthouse
 rules:
   - apiGroups: [""]
-    resources: ["services", "namespaces", "configmaps"]
+    resources: ["services", "namespaces", "configmaps", "endpoints"]
     verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
   - apiGroups: ["lighthouse.submariner.io"]
     resources: ["*"]
     verbs: ["create", "get", "list", "watch", "update", "delete"]