fix(rbac): Fix rbac permissions (#25)

Some permissions were not generated correctly and other permissions were missing an apiGroup definition. Tested locally.
checkly · Jul 28, 2022 · 0ffdc1a · 0ffdc1a
1 parent 92e146b
commit 0ffdc1a
Show file tree

Hide file tree

Showing 6 changed files with 15 additions and 13 deletions.
diff --git a/config/rbac/api_editor_role.yaml b/config/rbac/api_editor_role.yaml
@@ -5,7 +5,7 @@ metadata:
   name: api-editor-role
 rules:
 - apiGroups:
-  - check.checklyhq.com
+  - k8s.checklyhq.com
   resources:
   - apis
   verbs:
@@ -17,7 +17,7 @@ rules:
   - update
   - watch
 - apiGroups:
-  - check.checklyhq.com
+  - k8s.checklyhq.com
   resources:
   - apis/status
   verbs:

diff --git a/config/rbac/api_viewer_role.yaml b/config/rbac/api_viewer_role.yaml
@@ -5,15 +5,15 @@ metadata:
   name: api-viewer-role
 rules:
 - apiGroups:
-  - check.checklyhq.com
+  - k8s.checklyhq.com
   resources:
   - apis
   verbs:
   - get
   - list
   - watch
 - apiGroups:
-  - check.checklyhq.com
+  - k8s.checklyhq.com
   resources:
   - apis/status
   verbs:

diff --git a/config/rbac/checkly_alertchannel_editor_role.yaml b/config/rbac/checkly_alertchannel_editor_role.yaml
@@ -5,7 +5,7 @@ metadata:
   name: alertchannel-editor-role
 rules:
 - apiGroups:
-  - checkly.checklyhq.com
+  - k8s.checklyhq.com
   resources:
   - alertchannels
   verbs:
@@ -17,7 +17,7 @@ rules:
   - update
   - watch
 - apiGroups:
-  - checkly.checklyhq.com
+  - k8s.checklyhq.com
   resources:
   - alertchannels/status
   verbs:

diff --git a/config/rbac/checkly_alertchannel_viewer_role.yaml b/config/rbac/checkly_alertchannel_viewer_role.yaml
@@ -5,15 +5,15 @@ metadata:
   name: alertchannel-viewer-role
 rules:
 - apiGroups:
-  - checkly.checklyhq.com
+  - k8s.checklyhq.com
   resources:
   - alertchannels
   verbs:
   - get
   - list
   - watch
 - apiGroups:
-  - checkly.checklyhq.com
+  - k8s.checklyhq.com
   resources:
   - alertchannels/status
   verbs:

diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -5,7 +5,9 @@ metadata:
   creationTimestamp: null
   name: manager-role
 rules:
-- resources:
+- apiGroups:
+  - ""
+  resources:
   - secrets
   verbs:
   - get

diff --git a/controllers/checkly/alertchannel_controller.go b/controllers/checkly/alertchannel_controller.go
@@ -40,10 +40,10 @@ type AlertChannelReconciler struct {
 	ApiClient checkly.Client
 }
 
-//+kubebuilder:rbac:groups=checkly.checklyhq.com,resources=alertchannels,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=checkly.checklyhq.com,resources=alertchannels/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups=checkly.checklyhq.com,resources=alertchannels/finalizers,verbs=update
-//+kubebuilder:rbac:groups=,resources=secrets,verbs=get;list
+//+kubebuilder:rbac:groups=k8s.checklyhq.com,resources=alertchannels,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=k8s.checklyhq.com,resources=alertchannels/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=k8s.checklyhq.com,resources=alertchannels/finalizers,verbs=update
+//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.