Merge pull request #47 from coroot/cnpg_perconapg_permissions

rbac: grant cluster-agent access to CNPG/Percona Operator resources

Author: def

config/rbac/role.yaml

@@ -124,6 +124,25 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - pgv2.percona.com
+  resources:
+  - perconapgbackups
+  - perconapgclusters
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - postgresql.cnpg.io
+  resources:
+  - backups
+  - clusters
+  - scheduledbackups
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

controller/cluster_agent.go

@@ -82,6 +82,16 @@ func (r *CorootReconciler) clusterAgentClusterRole(cr *corootv1.Coroot) *rbacv1.
 				Resources: []string{"applications", "applicationsets", "appprojects"},
 				Verbs:     verbs,
 			},
+			{
+				APIGroups: []string{"postgresql.cnpg.io"},
+				Resources: []string{"clusters", "backups", "scheduledbackups"},
+				Verbs:     verbs,
+			},
+			{
+				APIGroups: []string{"pgv2.percona.com"},
+				Resources: []string{"perconapgclusters", "perconapgbackups"},
+				Verbs:     verbs,
+			},
 		},
 	}
 	return role

controller/controller.go

@@ -134,6 +134,8 @@ func detectIngressAPIVersion(mgr ctrl.Manager) string {
 // +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch
 // +kubebuilder:rbac:groups=source.toolkit.fluxcd.io;kustomize.toolkit.fluxcd.io;helm.toolkit.fluxcd.io;notification.toolkit.fluxcd.io;image.toolkit.fluxcd.io;fluxcd.controlplane.io,resources=*,verbs=get;list;watch
 // +kubebuilder:rbac:groups=argoproj.io,resources=applications;applicationsets;appprojects,verbs=get;list;watch
+// +kubebuilder:rbac:groups=postgresql.cnpg.io,resources=clusters;backups;scheduledbackups,verbs=get;list;watch
+// +kubebuilder:rbac:groups=pgv2.percona.com,resources=perconapgclusters;perconapgbackups,verbs=get;list;watch
 
 func (r *CorootReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	logger := ctrl.Log.WithValues("namespace", req.Namespace, "name", req.Name)