helm: allow watching namespaces.

I can't figure out how to grant access to watch our namespace with role-based RBAC rules. I can only get it working with this clustterole RBAC rule. This might be too permissive, as IIUC it allows watching any namespace we know by name... Signed-off-by: Krisztian Litkey <[email protected]>
klihub · Jul 17, 2024 · 3e2b661 · 3e2b661
1 parent 118c0ab
commit 3e2b661
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/deployment/helm/cdi-device-injector/templates/clusterrole.yaml b/deployment/helm/cdi-device-injector/templates/clusterrole.yaml
@@ -5,3 +5,10 @@ metadata:
   labels:
     {{- include "nri-plugin.labels" . | nindent 4 }}
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - watch