Remove watch Secret from RBAC role

One consequence of disabling caching for Secret resources, as in the previous commit, is that `watch` permission for those is no longer required. Signed-off-by: Michael Bridgen <[email protected]>
weaveworks · Apr 25, 2023 · e2ff348 · e2ff348
1 parent 943be32
commit e2ff348
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -19,7 +19,6 @@ rules:
   verbs:
   - get
   - list
-  - watch
 - apiGroups:
   - ""
   resources:

diff --git a/controllers/gitopsset_controller.go b/controllers/gitopsset_controller.go
@@ -84,7 +84,7 @@ func (r *GitOpsSetReconciler) event(obj *templatesv1.GitOpsSet, severity, msg st
 //+kubebuilder:rbac:groups=templates.weave.works,resources=gitopssets/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=templates.weave.works,resources=gitopssets/finalizers,verbs=update
 //+kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=gitrepositories,verbs=get;list;watch
-//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
+//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list
 //+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=impersonate
 //+kubebuilder:rbac:groups=gitops.weave.works,resources=gitopsclusters,verbs=get;list;watch
 //+kubebuilder:rbac:groups="",resources=events,verbs=create;patch