Reduce submariner-operator RBAC permissions

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>

submariner-operator/templates/rbac.yaml

@@ -9,62 +9,77 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups:
+  - apiGroups:
-  - ""
+      - ""
-  resources:
+    resources:
-  - pods
+      # For metrics
-  - services
+      - services
-  - services/finalizers
+    verbs:
-  - endpoints
+      - get
-  - persistentvolumeclaims
+      - create
-  - events
+      - update
-  - configmaps
+  - apiGroups:
-  - secrets
+      - ""
-  verbs:
+    resources:
-  - '*'
+      # Temporarily needed for network-plugin syncer removal
-- apiGroups:
+      - serviceaccounts
-  - apps
+    resourceNames:
-  resources:
+      - submariner-networkplugin-syncer
-  - deployments
+    verbs:
-  - daemonsets
+      - delete
-  - replicasets
+  - apiGroups:
-  - statefulsets
+      - apps
-  verbs:
+    resources:
-  - '*'
+      - deployments
-- apiGroups:
+      - daemonsets
-  - monitoring.coreos.com
+    verbs:
-  resources:
+      - create
-  - servicemonitors
+      - delete
-  verbs:
+      - get
-  - get
+      - list
-  - create
+      - patch
-- apiGroups:
+      - update
-  - apps
+      - watch
-  resourceNames:
+  - apiGroups:
-  - {{ template "submariner.fullname" . }}
+      - monitoring.coreos.com
-  resources:
+    resources:
-  - deployments/finalizers
+      # Needed for openshift monitoring
-  verbs:
+      - servicemonitors
-  - update
+    verbs:
-- apiGroups:
+      - get
-  - ""
+      - create
-  resources:
+  - apiGroups:
-  - pods
+      - apps
-  verbs:
+    resourceNames:
-  - get
+      - {{ template "submariner.fullname" . }}
-- apiGroups:
+    resources:
-  - apps
+      - deployments/finalizers
-  resources:
+    verbs:
-  - replicasets
+      - update
-  verbs:
+  - apiGroups:
-  - get
+      - submariner.io
-- apiGroups:
+    resources:
-  - submariner.io
+      - brokers
-  resources:
+      - brokers/status
-  - '*'
+      - submariners
-  - servicediscoveries
+      - submariners/status
-  verbs:
+      - servicediscoveries
-  - '*'
+      - servicediscoveries/status
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - gateways
+    verbs:
+      - get
+      - list
+      - watch
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -435,9 +450,10 @@ rules:
       - update
       - delete
       - watch
-  - apiGroups:  # pods, services and nodes are looked up to figure out network settings
+  - apiGroups:
       - ""
     resources:
+      # Needed for network settings discovery
       - pods
       - services
       - nodes
@@ -451,27 +467,20 @@ rules:
       - dnses
     verbs:
       - get
-      - list
-      - watch
       - update
   - apiGroups:
       - config.openshift.io
     resources:
+      # Needed for network settings discovery
       - networks
+    resourceNames:
+      - cluster
     verbs:
       - get
-      - list
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - monitoring.coreos.com
     resources:
+      # Needed for openshift monitoring
       - servicemonitors
     verbs:
       - get
@@ -479,11 +488,21 @@ rules:
   - apiGroups:
       - apps
     resources:
+      # Needed for Flannel CNI discovery
       - daemonsets
     verbs:
-      - get
       - list
-      - watch
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      # Temporarily needed for network-plugin syncer removal
+      - clusterroles
+      - clusterrolebindings
+    resourceNames:
+      - ocp-submariner-networkplugin-syncer
+      - submariner-networkplugin-syncer
+    verbs:
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding