Allow tenant SA to patch cluster status to report compilation metadata

projectsyn · Jun 3, 2024 · 113ba12 · 113ba12
1 parent 5b9b4dd
commit 113ba12
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/role/role.go b/role/role.go
@@ -52,7 +52,12 @@ func EnsureRules(role *rbacv1.Role) int {
 			Verbs:     []string{"get"},
 			Resources: []string{"tenants", "clusters"},
 		}
-		role.Rules = append(role.Rules, rule)
+		statusRule := rbacv1.PolicyRule{
+			APIGroups: []string{synv1alpha1.GroupVersion.Group},
+			Verbs:     []string{"get", "update", "patch"},
+			Resources: []string{"clusters/status"},
+		}
+		role.Rules = append(role.Rules, rule, statusRule)
 		i = len(role.Rules) - 1
 	}