Merge pull request #746 from NVIDIA/olm-bundle-rbac

NVIDIA · Jun 11, 2024 · f116381 · f116381
2 parents 30dddf9 + ba3dfc4
commit f116381
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 117 deletions.
diff --git a/bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml b/bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml
@@ -587,7 +587,12 @@ spec:
         - apiGroups:
           - nvidia.com
           resources:
-          - '*'
+          - clusterpolicies
+          - clusterpolicies/finalizers
+          - clusterpolicies/status
+          - nvidiadrivers
+          - nvidiadrivers/finalizers
+          - nvidiadrivers/status
           verbs:
           - create
           - delete
@@ -610,7 +615,14 @@ spec:
           resources:
           - securitycontextconstraints
           verbs:
-          - '*'
+          - use
+          - create
+          - get
+          - list
+          - watch
+          - patch
+          - update
+          - delete
         - apiGroups:
           - security.openshift.io
           resources:
@@ -627,7 +639,13 @@ spec:
           - roles
           - rolebindings
           verbs:
-          - '*'
+          - create
+          - get
+          - list
+          - watch
+          - update
+          - patch
+          - delete
         - apiGroups:
           - ""
           resources:
@@ -656,8 +674,6 @@ spec:
           resources:
           - deployments
           - daemonsets
-          - replicasets
-          - statefulsets
           verbs:
           - create
           - delete
@@ -690,7 +706,13 @@ spec:
           resources:
           - leases
           verbs:
-          - '*'
+          - create
+          - get
+          - list
+          - watch
+          - update
+          - patch
+          - delete
         - apiGroups:
           - monitoring.coreos.com
           resources:
@@ -716,121 +738,13 @@ spec:
           resources:
           - customresourcedefinitions
           verbs:
-          - get
-          - list
-          - watch
-      permissions:
-      - serviceAccountName: gpu-operator
-        rules:
-        - apiGroups:
-          - rbac.authorization.k8s.io
-          resources:
-          - roles
-          - rolebindings
-          verbs:
-          - '*'
-        - apiGroups:
-          - ""
-          resources:
-          - pods
-          - pods/eviction
-          - services
-          - services/finalizers
-          - endpoints
-          - persistentvolumeclaims
-          - events
-          - configmaps
-          - secrets
-          verbs:
           - create
-          - delete
           - get
           - list
-          - patch
-          - update
           - watch
-        - apiGroups:
-          - apps
-          resources:
-          - deployments
-          - daemonsets
-          - replicasets
-          - statefulsets
-          verbs:
-          - create
-          - delete
-          - get
-          - list
-          - patch
           - update
-          - watch
-        - apiGroups:
-          - apps
-          resources:
-          - controllerrevisions
-          verbs:
-          - get
-          - list
-          - watch
-        - apiGroups:
-          - monitoring.coreos.com
-          resources:
-          - servicemonitors
-          - prometheusrules
-          verbs:
-          - get
-          - create
-          - list
-          - update
-          - watch
-          - delete
-        - apiGroups:
-          - apps
-          resourceNames:
-          - gpu-operator
-          resources:
-          - deployments/finalizers
-          verbs:
-          - update
-        - apiGroups:
-          - ""
-          resources:
-          - pods
-          verbs:
-          - get
-        - apiGroups:
-          - apps
-          resources:
-          - replicasets
-          - deployments
-          verbs:
-          - get
-        - apiGroups:
-          - nvidia.com
-          resources:
-          - '*'
-          verbs:
-          - create
-          - delete
-          - get
-          - list
           - patch
-          - update
-          - watch
-        - apiGroups:
-          - coordination.k8s.io
-          resources:
-          - leases
-          verbs:
-          - '*'
-        - apiGroups:
-          - apiextensions.k8s.io
-          resources:
-          - customresourcedefinitions
-          verbs:
-          - get
-          - list
-          - watch
+          - delete
       deployments:
       - name: gpu-operator
         spec:

diff --git a/deployments/gpu-operator/templates/clusterrole.yaml b/deployments/gpu-operator/templates/clusterrole.yaml
@@ -147,10 +147,8 @@ rules:
   - list
   - watch
 - apiGroups:
-  - ""
   - coordination.k8s.io
   resources:
-  - configmaps
   - leases
   verbs:
   - get