Files
homelab/cluster-config/components/amq-streams-v1/base/clusterrole.yaml

399 lines
10 KiB
YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: amq-streams-installer-clusterrole
rules:
# ClusterRoles and ClusterRoleBindings for the controllers of the extension
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterroles
verbs:
- "*"
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterrolebindings
verbs:
- "*"
- apiGroups:
- olm.operatorframework.io
resources:
- clusterextensions/finalizers
verbs:
- update
# Scoped to the name of the ClusterExtension
resourceNames:
- amq-streams # the value from <metadata.name> from the extension's custom resource (CR)
# Deployments specified in install.spec.deployments
- apiGroups:
- apps
resources:
- deployments
verbs:
- create
- list
- watch
- apiGroups:
- apps
resources:
- deployments
verbs:
- get
- update
- patch
- delete
# scoped to the extension controller deployment name
resourceNames:
- amq-streams-cluster-operator
- amq-streams-cluster-operator-v2.9.0-0
# Service accounts in the CSV
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- create
- list
- watch
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- get
- update
- patch
- delete
# scoped to the extension controller's deployment service account
resourceNames:
- strimzi-cluster-operator
# configmaps
- apiGroups:
- ""
resources:
- configmaps
verbs:
- create
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- update
- patch
- delete
# scoped to the configmap name
resourceNames:
- strimzi-cluster-operator
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- create
- list
- watch
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- update
- patch
- delete
resourceNames:
- kafkas.kafka.strimzi.io
- kafkanodepools.kafka.strimzi.io
- kafkaconnects.kafka.strimzi.io
- kafkamirrormakers.kafka.strimzi.io
- kafkabridges.kafka.strimzi.io
- kafkatopics.kafka.strimzi.io
- kafkausers.kafka.strimzi.io
- kafkaconnectors.kafka.strimzi.io
- kafkamirrormaker2s.kafka.strimzi.io
- kafkarebalances.kafka.strimzi.io
- strimzipodsets.core.strimzi.io
# install permissions from CSV
- apiGroups:
- "rbac.authorization.k8s.io"
resources:
# The cluster operator needs to access and manage rolebindings to grant Strimzi components cluster permissions
- rolebindings
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- "rbac.authorization.k8s.io"
resources:
# The cluster operator needs to access and manage roles to grant the entity operator permissions
- roles
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- ""
resources:
# The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
- pods
# The cluster operator needs to access and manage service accounts to grant Strimzi components cluster permissions
- serviceaccounts
# The cluster operator needs to access and manage config maps for Strimzi components configuration
- configmaps
# The cluster operator needs to access and manage services and endpoints to expose Strimzi components to network traffic
- services
- endpoints
# The cluster operator needs to access and manage secrets to handle credentials
# The entity operator user-operator needs to access and manage secrets to store generated credentials
- secrets
# The cluster operator needs to access and manage persistent volume claims to bind them to Strimzi components for persistent data
- persistentvolumeclaims
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- "kafka.strimzi.io"
resources:
# The Cluster Operator operates the Strimzi custom resources
- kafkas
- kafkanodepools
- kafkaconnects
- kafkaconnectors
- kafkamirrormakers
- kafkabridges
- kafkamirrormaker2s
- kafkarebalances
- kafkatopics
- kafkausers
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- "kafka.strimzi.io"
resources:
# The Cluster Operator needs to manage the status of the Strimzi custom resources
- kafkas/status
- kafkanodepools/status
- kafkaconnects/status
- kafkaconnectors/status
- kafkamirrormakers/status
- kafkabridges/status
- kafkamirrormaker2s/status
- kafkarebalances/status
- kafkatopics/status
- kafkausers/status
verbs:
- get
- patch
- update
- apiGroups:
- "core.strimzi.io"
resources:
# The cluster operator uses StrimziPodSets to manage the Kafka and ZooKeeper pods
- strimzipodsets
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- "core.strimzi.io"
resources:
# The Cluster Operator needs to manage the status of the StrimziPodSet custom resource
- strimzipodsets/status
verbs:
- get
- patch
- update
- apiGroups:
- "kafka.strimzi.io"
resources:
# The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing)
- kafkarebalances
verbs:
- delete
- apiGroups:
- "apps"
resources:
# The cluster operator needs to access and manage deployments to run deployment based Strimzi components
- deployments
# The cluster operator needs to access and manage stateful sets to run stateful sets based Strimzi components
- statefulsets
# The cluster operator needs to access replica-sets to manage Strimzi components and to determine error states
- replicasets
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- "apps"
resources:
# The Cluster Operator needs to scale Deployments while migrating Connect and Mirror Maker 2 clusters from Deployments to StrimziPodSets
- deployments/scale
verbs:
- get
- patch
- update
- apiGroups:
- "" # legacy core events api, used by topic operator
- "events.k8s.io" # new events api, used by cluster operator
resources:
- events
verbs:
- create
- apiGroups:
# Kafka Connect Build on OpenShift requirement
- build.openshift.io
resources:
- buildconfigs
- buildconfigs/instantiate
- builds
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- networking.k8s.io
resources:
# The cluster operator needs to access and manage network policies to lock down communication between Strimzi components
- networkpolicies
# The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster
- ingresses
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- route.openshift.io
resources:
# The cluster operator needs to access and manage routes to expose Strimzi components for external access
- routes
- routes/custom-host
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- image.openshift.io
resources:
# The cluster operator needs to verify the image stream when used for Kafka Connect image build
- imagestreams
verbs:
- get
- apiGroups:
- policy
resources:
# The cluster operator needs to access and manage pod disruption budgets this limits the number of concurrent disruptions
# that a Streams component experiences, allowing for higher availability
- poddisruptionbudgets
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- coordination.k8s.io
resources:
# The cluster operator needs to access and manage leases for leader election
# The "create" verb cannot be used with "resourceNames"
- leases
verbs:
- create
- apiGroups:
- coordination.k8s.io
resources:
# The cluster operator needs to access and manage leases for leader election
- leases
resourceNames:
# The default RBAC files give the operator only access to the Lease resource names strimzi-cluster-operator
# If you want to use another resource name or resource namespace, you have to configure the RBAC resources accordingly
- strimzi-cluster-operator
verbs:
- get
- list
- watch
- delete
- patch
- update
# Cluster permissions from CSV
- apiGroups:
- "rbac.authorization.k8s.io"
resources:
# The cluster operator needs to create and manage cluster role bindings in the case of an install where a user
# has specified they want their cluster role bindings generated
- clusterrolebindings
verbs:
- get
- list
- watch
- create
- delete
- patch
- update
- apiGroups:
- storage.k8s.io
resources:
# The cluster operator requires "get" permissions to view storage class details
# This is because only a persistent volume of a supported storage class type can be resized
- storageclasses
verbs:
- get
- apiGroups:
- ""
resources:
# The cluster operator requires "list" permissions to view all nodes in a cluster
# The listing is used to determine the node addresses when NodePort access is configured
# These addresses are then exposed in the custom resource states
# The Kafka Brokers require "get" permissions to view the node they are on
# This information is used to generate a Rack ID that is used for High Availability configurations
- nodes
verbs:
- get
- list