role.yaml

# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: knative-eventing-operator-aggregated
aggregationRule:
  clusterRoleSelectors:
# This (along with escalate below) allows the Operator to pick up any
# roles that are provided to the admin of the cluster by knative eventing
# automatically.
  - matchExpressions:
      - {key: eventing.knative.dev/release, operator: Exists}
rules: [] # Rules are automatically filled in by the controller manager.
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: knative-eventing-operator
rules:
- apiGroups:
  - operator.knative.dev
  resources:
  - '*'
  verbs:
  - '*'
# Bootstrapping permissions.
# Roles that are explicitly bound buch which are specified by this Operator
# MUST be specified here with 'get' and 'bind'.
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterroles
  - roles
  verbs:
  - create
  - delete
# Escalate is necessary in order to create a role using cluster role aggregation,
# and to allow the Operator to bootstrap itself into the necessary set of
# permissions, even as those continue to evolve upstream.
  - escalate
  - get
  - list
  - update
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - rolebindings
  verbs:
  - create
  - delete
  - list
  - get
  - update
# Permissions required for Knative controller
# infra.
- apiGroups:
  - apiregistration.k8s.io
  resources:
  - apiservices
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - caching.internal.knative.dev
  resources:
  - images
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - update
  - watch
- apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - update
  - patch
- apiGroups:
  - ''
  resources:
  - configmaps
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  - daemonsets
  - replicasets
  - statefulsets
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - apiregistration.k8s.io
  resources:
  - apiservices
  verbs:
  - create
  - delete
  - get
  - list
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - create
  - delete
  - update
  - get
  - list
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - '*'
- apiGroups:
  - batch
  resources:
  - jobs
  verbs:
  - create
  - delete
  - update
  - get
  - list
  - watch