Empty groups field is required in kubebuilder rbac marker.

Author: joshlreese

config/rbac/role.yaml

@@ -4,7 +4,9 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
-- resources:
+- apiGroups:
+  - ""
+  resources:
   - configmaps
   - namespaces
   - secrets

config/rbac_downstream/role.yaml

@@ -4,7 +4,9 @@ kind: ClusterRole
 metadata:
   name: downstream-manager-role
 rules:
-- resources:
+- apiGroups:
+  - ""
+  resources:
   - configmaps
   - namespaces
   - secrets

config/rbac_upstream/role.yaml

@@ -4,7 +4,9 @@ kind: ClusterRole
 metadata:
   name: upstream-manager-role
 rules:
-- resources:
+- apiGroups:
+  - ""
+  resources:
   - configmaps
   - secrets
   verbs:

internal/controller/rbac/downstream/downstream_rbac.go

@@ -1,8 +1,8 @@
 package downstream
 
-// +kubebuilder:rbac:resources=configmaps,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:resources=namespaces,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:resources=secrets,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
 
 // Crossplane GCP resources (downstream control plane)
 // +kubebuilder:rbac:groups=cloudplatform.gcp.upbound.io,resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete

internal/controller/rbac/upstream/upstream_rbac.go

@@ -1,7 +1,7 @@
 package upstream
 
-// +kubebuilder:rbac:resources=configmaps,verbs=get;list;watch
-// +kubebuilder:rbac:resources=secrets,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
 
 // +kubebuilder:rbac:groups=compute.datumapis.com,resources=instances,verbs=get;list;watch
 // +kubebuilder:rbac:groups=compute.datumapis.com,resources=instances/status,verbs=get;update;patch