calico: Update RBAC permissions of the controllers
This commit updates the ClusterRole `calico-kube-controllers` with
enhanced permissions.
It allows the access to CRD `hostendpoints` and
`kubecontrollersconfigurations`.
@@ -93,6 +93,16 @@ rules:
- create
- update
- delete
+ # kube-controllers manages hostendpoints.
+ - apiGroups: ["crd.projectcalico.org"]
+ resources:
+ - hostendpoints
+ verbs:
+ - get
+ - list
+ - create
+ - update
+ - delete
# Needs access to update clusterinformations.
- apiGroups: ["crd.projectcalico.org"]
resources:
@@ -109,6 +119,19 @@ rules:
- use
resourceNames:
- calico-kube-controllers
+ # KubeControllersConfiguration is where it gets its config
+ - apiGroups: ["crd.projectcalico.org"]
+ resources:
+ - kubecontrollersconfigurations
+ verbs:
+ # read its own config
+ - get
+ # create a default if none exists
+ - create
+ # update status
+ - update
+ # watch for changes
+ - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
