Allow controller access to serviceaccounts

appuio · Nov 2, 2023 · bc634ef · bc634ef
1 parent 14de45e
commit bc634ef
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -15,6 +15,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - cluster.appuio.io
   resources:

diff --git a/controllers/emergencyaccount_controller.go b/controllers/emergencyaccount_controller.go
@@ -39,6 +39,8 @@ type EmergencyAccountReconciler struct {
 //+kubebuilder:rbac:groups=cluster.appuio.io,resources=emergencyaccounts/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=cluster.appuio.io,resources=emergencyaccounts/finalizers,verbs=update
 
+//+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
+
 // Reconcile reconciles the EmergencyAccount resource.
 // It creates a service account with the same name and namespace as the EmergencyAccount and requests a token for it.
 // The token is then stored in the configured stores.