wbsong111
88 lines
2.2 KiB
YAML
88 lines
2.2 KiB
YAML
{{- if and .Values.rbac.create .Values.createGlobalResources -}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: strimzi-cluster-operator-watched
|
|
labels:
|
|
app: {{ template "strimzi.name" . }}
|
|
chart: {{ template "strimzi.chart" . }}
|
|
component: role
|
|
release: {{ .Release.Name }}
|
|
heritage: {{ .Release.Service }}
|
|
rules:
|
|
# Resources in this role are being watched by the operator. When operator is deployed as cluster-wide, these permissions
|
|
# need to be granted to the operator on a cluster wide level as well, even if the operands will be deployed only in
|
|
# few of the namespaces in given cluster. This is required to set up the Kubernetes watches and informers.
|
|
# Note: The rights included in this role might change in the future
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
|
|
- pods
|
|
verbs:
|
|
- watch
|
|
- list
|
|
- apiGroups:
|
|
- "kafka.strimzi.io"
|
|
resources:
|
|
# The Cluster Operator operates the Strimzi custom resources
|
|
- kafkas
|
|
- kafkanodepools
|
|
- kafkaconnects
|
|
- kafkaconnectors
|
|
- kafkabridges
|
|
- kafkamirrormaker2s
|
|
- kafkarebalances
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "kafka.strimzi.io"
|
|
resources:
|
|
# The Cluster Operator needs to manage the status of the Strimzi custom resources
|
|
- kafkas/status
|
|
- kafkanodepools/status
|
|
- kafkaconnects/status
|
|
- kafkaconnectors/status
|
|
- kafkabridges/status
|
|
- kafkamirrormaker2s/status
|
|
- kafkarebalances/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "core.strimzi.io"
|
|
resources:
|
|
# The cluster operator uses StrimziPodSets to manage the Kafka, Kafka Connect, and Kafka MirrorMaker 2 pods
|
|
- strimzipodsets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "core.strimzi.io"
|
|
resources:
|
|
# The Cluster Operator needs to manage the status of the StrimziPodSet custom resource
|
|
- strimzipodsets/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- "kafka.strimzi.io"
|
|
resources:
|
|
# The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing)
|
|
- kafkarebalances
|
|
verbs:
|
|
- delete
|
|
{{- end -}}
|