From 9d8c4f5dbd66aa15833cae2458c3a768b4eb2d41 Mon Sep 17 00:00:00 2001 From: Tom Pantelis Date: Mon, 20 May 2024 10:34:06 -0400 Subject: [PATCH] Add RBAC access to finalizers for the operator role On Openshift, the operator failed with error "\"submariner-gateway\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on" Openshift enables OwnerReferencesPermissionEnforcement, so in order to set blockOwnerDeletion for an object, the user needs update permission for the finalizers subresource of the referenced owner. In this case the owner is the Submariner object. Signed-off-by: Tom Pantelis --- submariner-operator/templates/rbac.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/submariner-operator/templates/rbac.yaml b/submariner-operator/templates/rbac.yaml index f42df52..b9563c8 100644 --- a/submariner-operator/templates/rbac.yaml +++ b/submariner-operator/templates/rbac.yaml @@ -81,6 +81,13 @@ rules: - get - list - watch + - apiGroups: + - submariner.io + resources: + - submariners/finalizers + - servicediscoveries/finalizers + verbs: + - update --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1