Add PV patch RBAC for external provisioner sidecar (#546)

For newer versions of the sidecar, this is needed to achieve PV finalizer orchestration. ``` E1219 13:01:22.150741 1 controller.go:1025] error syncing volume "pvc-45bfe11e-d5e3-4275-8df0-652f84de15a7": persistentvolumes "pvc-45bfe11e-d5e3-4275-8df0-652f84de15a7" is forbidden: User "system:serviceaccount:openshift-cnv:hostpath-provisioner-admin-csi" cannot patch resource "persistentvolumes" in API group "" at the cluster scope ``` Signed-off-by: Alex Kalenyuk <[email protected]>
kubevirt · Dec 19, 2024 · 6f05e85 · 6f05e85
1 parent dcbd191
commit 6f05e85
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 0 deletions.
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
@@ -18,6 +18,7 @@ rules:
   - watch
   - create
   - delete
+  - patch
 - apiGroups:
   - ""
   resources:

diff --git a/pkg/controller/hostpathprovisioner/controller_test.go b/pkg/controller/hostpathprovisioner/controller_test.go
@@ -732,6 +732,7 @@ func verifyCreateCSIClusterRole(cl client.Client, enableSnapshot bool) {
 				"watch",
 				"create",
 				"delete",
+				"patch",
 			},
 		},
 		{

diff --git a/pkg/controller/hostpathprovisioner/rbac.go b/pkg/controller/hostpathprovisioner/rbac.go
@@ -250,6 +250,7 @@ func (r *ReconcileHostPathProvisioner) createCsiClusterRoleObjectProvisioner(cr
 					"watch",
 					"create",
 					"delete",
+					"patch",
 				},
 			},
 			{

diff --git a/tools/helper/cluster_role_generated.go b/tools/helper/cluster_role_generated.go
@@ -18,6 +18,7 @@ rules:
   - watch
   - create
   - delete
+  - patch
 - apiGroups:
   - ""
   resources:
-Original file line number
+Diff line change
@@ Expand Up / @@ -18,6 +18,7 @@ rules: @@
       - watch
       - create
       - delete
+      - patch
     - apiGroups:
       - ""
       resources:
@@ Expand Down @@