399 lines
10 KiB
YAML
399 lines
10 KiB
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: amq-streams-installer-clusterrole
|
|
rules:
|
|
# ClusterRoles and ClusterRoleBindings for the controllers of the extension
|
|
- apiGroups:
|
|
- rbac.authorization.k8s.io
|
|
resources:
|
|
- clusterroles
|
|
verbs:
|
|
- "*"
|
|
- apiGroups:
|
|
- rbac.authorization.k8s.io
|
|
resources:
|
|
- clusterrolebindings
|
|
verbs:
|
|
- "*"
|
|
- apiGroups:
|
|
- olm.operatorframework.io
|
|
resources:
|
|
- clusterextensions/finalizers
|
|
verbs:
|
|
- update
|
|
# Scoped to the name of the ClusterExtension
|
|
resourceNames:
|
|
- amq-streams # the value from <metadata.name> from the extension's custom resource (CR)
|
|
# Deployments specified in install.spec.deployments
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- create
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- get
|
|
- update
|
|
- patch
|
|
- delete
|
|
# scoped to the extension controller deployment name
|
|
resourceNames:
|
|
- amq-streams-cluster-operator
|
|
- amq-streams-cluster-operator-v2.9.0-0
|
|
# Service accounts in the CSV
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- serviceaccounts
|
|
verbs:
|
|
- create
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- serviceaccounts
|
|
verbs:
|
|
- get
|
|
- update
|
|
- patch
|
|
- delete
|
|
# scoped to the extension controller's deployment service account
|
|
resourceNames:
|
|
- strimzi-cluster-operator
|
|
# configmaps
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- patch
|
|
- delete
|
|
# scoped to the configmap name
|
|
resourceNames:
|
|
- strimzi-cluster-operator
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- create
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- get
|
|
- update
|
|
- patch
|
|
- delete
|
|
resourceNames:
|
|
- kafkas.kafka.strimzi.io
|
|
- kafkanodepools.kafka.strimzi.io
|
|
- kafkaconnects.kafka.strimzi.io
|
|
- kafkamirrormakers.kafka.strimzi.io
|
|
- kafkabridges.kafka.strimzi.io
|
|
- kafkatopics.kafka.strimzi.io
|
|
- kafkausers.kafka.strimzi.io
|
|
- kafkaconnectors.kafka.strimzi.io
|
|
- kafkamirrormaker2s.kafka.strimzi.io
|
|
- kafkarebalances.kafka.strimzi.io
|
|
- strimzipodsets.core.strimzi.io
|
|
# install permissions from CSV
|
|
- apiGroups:
|
|
- "rbac.authorization.k8s.io"
|
|
resources:
|
|
# The cluster operator needs to access and manage rolebindings to grant Strimzi components cluster permissions
|
|
- rolebindings
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "rbac.authorization.k8s.io"
|
|
resources:
|
|
# The cluster operator needs to access and manage roles to grant the entity operator permissions
|
|
- roles
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
|
|
- pods
|
|
# The cluster operator needs to access and manage service accounts to grant Strimzi components cluster permissions
|
|
- serviceaccounts
|
|
# The cluster operator needs to access and manage config maps for Strimzi components configuration
|
|
- configmaps
|
|
# The cluster operator needs to access and manage services and endpoints to expose Strimzi components to network traffic
|
|
- services
|
|
- endpoints
|
|
# The cluster operator needs to access and manage secrets to handle credentials
|
|
# The entity operator user-operator needs to access and manage secrets to store generated credentials
|
|
- secrets
|
|
# The cluster operator needs to access and manage persistent volume claims to bind them to Strimzi components for persistent data
|
|
- persistentvolumeclaims
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "kafka.strimzi.io"
|
|
resources:
|
|
# The Cluster Operator operates the Strimzi custom resources
|
|
- kafkas
|
|
- kafkanodepools
|
|
- kafkaconnects
|
|
- kafkaconnectors
|
|
- kafkamirrormakers
|
|
- kafkabridges
|
|
- kafkamirrormaker2s
|
|
- kafkarebalances
|
|
- kafkatopics
|
|
- kafkausers
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "kafka.strimzi.io"
|
|
resources:
|
|
# The Cluster Operator needs to manage the status of the Strimzi custom resources
|
|
- kafkas/status
|
|
- kafkanodepools/status
|
|
- kafkaconnects/status
|
|
- kafkaconnectors/status
|
|
- kafkamirrormakers/status
|
|
- kafkabridges/status
|
|
- kafkamirrormaker2s/status
|
|
- kafkarebalances/status
|
|
- kafkatopics/status
|
|
- kafkausers/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "core.strimzi.io"
|
|
resources:
|
|
# The cluster operator uses StrimziPodSets to manage the Kafka and ZooKeeper pods
|
|
- strimzipodsets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "core.strimzi.io"
|
|
resources:
|
|
# The Cluster Operator needs to manage the status of the StrimziPodSet custom resource
|
|
- strimzipodsets/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "kafka.strimzi.io"
|
|
resources:
|
|
# The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing)
|
|
- kafkarebalances
|
|
verbs:
|
|
- delete
|
|
- apiGroups:
|
|
- "apps"
|
|
resources:
|
|
# The cluster operator needs to access and manage deployments to run deployment based Strimzi components
|
|
- deployments
|
|
# The cluster operator needs to access and manage stateful sets to run stateful sets based Strimzi components
|
|
- statefulsets
|
|
# The cluster operator needs to access replica-sets to manage Strimzi components and to determine error states
|
|
- replicasets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "apps"
|
|
resources:
|
|
# The Cluster Operator needs to scale Deployments while migrating Connect and Mirror Maker 2 clusters from Deployments to StrimziPodSets
|
|
- deployments/scale
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "" # legacy core events api, used by topic operator
|
|
- "events.k8s.io" # new events api, used by cluster operator
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
# Kafka Connect Build on OpenShift requirement
|
|
- build.openshift.io
|
|
resources:
|
|
- buildconfigs
|
|
- buildconfigs/instantiate
|
|
- builds
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
# The cluster operator needs to access and manage network policies to lock down communication between Strimzi components
|
|
- networkpolicies
|
|
# The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster
|
|
- ingresses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- route.openshift.io
|
|
resources:
|
|
# The cluster operator needs to access and manage routes to expose Strimzi components for external access
|
|
- routes
|
|
- routes/custom-host
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- image.openshift.io
|
|
resources:
|
|
# The cluster operator needs to verify the image stream when used for Kafka Connect image build
|
|
- imagestreams
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- policy
|
|
resources:
|
|
# The cluster operator needs to access and manage pod disruption budgets this limits the number of concurrent disruptions
|
|
# that a Streams component experiences, allowing for higher availability
|
|
- poddisruptionbudgets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
# The cluster operator needs to access and manage leases for leader election
|
|
# The "create" verb cannot be used with "resourceNames"
|
|
- leases
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
# The cluster operator needs to access and manage leases for leader election
|
|
- leases
|
|
resourceNames:
|
|
# The default RBAC files give the operator only access to the Lease resource names strimzi-cluster-operator
|
|
# If you want to use another resource name or resource namespace, you have to configure the RBAC resources accordingly
|
|
- strimzi-cluster-operator
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- delete
|
|
- patch
|
|
- update
|
|
# Cluster permissions from CSV
|
|
- apiGroups:
|
|
- "rbac.authorization.k8s.io"
|
|
resources:
|
|
# The cluster operator needs to create and manage cluster role bindings in the case of an install where a user
|
|
# has specified they want their cluster role bindings generated
|
|
- clusterrolebindings
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- storage.k8s.io
|
|
resources:
|
|
# The cluster operator requires "get" permissions to view storage class details
|
|
# This is because only a persistent volume of a supported storage class type can be resized
|
|
- storageclasses
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# The cluster operator requires "list" permissions to view all nodes in a cluster
|
|
# The listing is used to determine the node addresses when NodePort access is configured
|
|
# These addresses are then exposed in the custom resource states
|
|
# The Kafka Brokers require "get" permissions to view the node they are on
|
|
# This information is used to generate a Rack ID that is used for High Availability configurations
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|