Add cluster-role observatorium-logs-edit for dedicated-admins (rhobs#353

)
philipgough · Oct 10, 2022 · 87aa3ad · 87aa3ad
1 parent 5a90b94
commit 87aa3ad
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 0 deletions.
diff --git a/crds/observatorium-logs-crds-template.jsonnet b/crds/observatorium-logs-crds-template.jsonnet
@@ -1,4 +1,22 @@
 {
+  local clusterRole = {
+    apiVersion: 'rbac.authorization.k8s.io/v1',
+    kind: 'ClusterRole',
+    metadata: {
+      name: 'observatorium-logs-edit',
+      annotations: {
+        'managed.openshift.io/aggregate-to-dedicated-admins': 'cluster',
+      },
+    },
+    rules: [
+      {
+        apiGroups: ['loki.grafana.com'],
+        resources: ['alertingrules', 'recordingrules'],
+        verbs: ['create', 'update', 'delete', 'patch', 'get', 'list', 'watch'],
+      },
+    ],
+  },
+
   apiVersion: 'template.openshift.io/v1',
   kind: 'Template',
   metadata: {
@@ -7,5 +25,6 @@
   objects: [
     (import 'loki.grafana.com_alertingrules.libsonnet'),
     (import 'loki.grafana.com_recordingrules.libsonnet'),
+    clusterRole,
   ],
 }
diff --git a/resources/crds/observatorium-logs-crds-template.yaml b/resources/crds/observatorium-logs-crds-template.yaml
@@ -297,3 +297,23 @@ objects:
       plural: ""
     conditions: null
     storedVersions: null
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  metadata:
+    annotations:
+      managed.openshift.io/aggregate-to-dedicated-admins: cluster
+    name: observatorium-logs-edit
+  rules:
+  - apiGroups:
+    - loki.grafana.com
+    resources:
+    - alertingrules
+    - recordingrules
+    verbs:
+    - create
+    - update
+    - delete
+    - patch
+    - get
+    - list
+    - watch