Revise appcatalog permissions

Signed-off-by: Tamal Saha <[email protected]>
stashed · Sep 20, 2024 · a8b4f09 · a8b4f09
1 parent 07e82e3
commit a8b4f09
Show file tree

Hide file tree

Showing 5 changed files with 62 additions and 22 deletions.
diff --git a/charts/stash-community/templates/appcatalog-user-roles.yaml b/charts/stash-community/templates/appcatalog-user-roles.yaml
@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: appscode:appcatalog:admin
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
+rules:
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["*"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: appscode:appcatalog:view
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
+rules:
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["get", "list", "watch"]
diff --git a/charts/stash-community/templates/user-roles.yaml b/charts/stash-community/templates/user-roles.yaml
@@ -13,11 +13,6 @@ rules:
   resources:
   - "*"
   verbs: ["*"]
-- apiGroups:
-  - appcatalog.appscode.com
-  resources:
-  - appbindings
-  verbs: ["*"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -51,8 +46,3 @@ rules:
   resources:
   - "*"
   verbs: ["get", "list", "watch"]
-- apiGroups:
-  - appcatalog.appscode.com
-  resources:
-  - appbindings
-  verbs: ["get", "list", "watch"]
diff --git a/charts/stash-enterprise/templates/appcatalog-user-roles.yaml b/charts/stash-enterprise/templates/appcatalog-user-roles.yaml
@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: appscode:appcatalog:admin
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
+rules:
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["*"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: appscode:appcatalog:view
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
+rules:
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["get", "list", "watch"]
diff --git a/charts/stash-enterprise/templates/user-roles.yaml b/charts/stash-enterprise/templates/user-roles.yaml
@@ -13,11 +13,6 @@ rules:
   resources:
   - "*"
   verbs: ["*"]
-- apiGroups:
-  - appcatalog.appscode.com
-  resources:
-  - appbindings
-  verbs: ["*"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -51,8 +46,3 @@ rules:
   resources:
   - "*"
   verbs: ["get", "list", "watch"]
-- apiGroups:
-  - appcatalog.appscode.com
-  resources:
-  - appbindings
-  verbs: ["get", "list", "watch"]
diff --git a/charts/stash-ui-server/templates/user-roles.yaml b/charts/stash-ui-server/templates/user-roles.yaml
@@ -3,8 +3,6 @@ kind: ClusterRole
 metadata:
   name: stash:ui:viewer
   labels:
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-view: "true"
   annotations:
     "helm.sh/hook": post-install,post-upgrade