chore(operator): read-only RBAC for KeptnConfig

Signed-off-by: Giovanni Liva <[email protected]>
keptn · Mar 23, 2023 · a4d534f · a4d534f
1 parent ad408fd
commit a4d534f
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 14 deletions.
diff --git a/operator/config/rbac/role.yaml b/operator/config/rbac/role.yaml
@@ -323,23 +323,12 @@ rules:
   - keptnconfigs
   verbs:
   - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
-- apiGroups:
-  - options.keptn.sh
-  resources:
-  - keptnconfigs/finalizers
-  verbs:
-  - update
 - apiGroups:
   - options.keptn.sh
   resources:
   - keptnconfigs/status
   verbs:
   - get
-  - patch
-  - update
diff --git a/operator/controllers/options/keptnconfig_controller.go b/operator/controllers/options/keptnconfig_controller.go
@@ -40,9 +40,8 @@ type KeptnConfigReconciler struct {
 	LastAppliedSpec *optionsv1alpha1.KeptnConfigSpec
 }
 
-// +kubebuilder:rbac:groups=options.keptn.sh,resources=keptnconfigs,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=options.keptn.sh,resources=keptnconfigs/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=options.keptn.sh,resources=keptnconfigs/finalizers,verbs=update
+// +kubebuilder:rbac:groups=options.keptn.sh,resources=keptnconfigs,verbs=get;list;watch;create
+// +kubebuilder:rbac:groups=options.keptn.sh,resources=keptnconfigs/status,verbs=get
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.