mirror of
https://github.com/kubernetes-sigs/node-feature-discovery.git
synced 2025-03-19 14:53:07 +00:00
3f012c2d5a
when OwnerReferencesPermissionEnforcement validating webhook is enabled additional permissions are required to set/update owner ref field. NFD worker sets/updates NodeFeature owner ref field to the worker pod and owning daemonset. owner reference can only be updated if the worker has delete permissions for NodeFeatures. if owner reference has blockOwnerDeletion (as the case for the daemonset owner reference) then it requires update permissions to the finalizers of the owner, to avoid this, we set blockOwnerDeleteion to false for all owners referenced from NFD worker pod when setting/updating NodeFeature owner ref. Signed-off-by: adrianc <adrianc@nvidia.com>
20 lines
260 B
YAML
20 lines
260 B
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: nfd-worker
|
|
rules:
|
|
- apiGroups:
|
|
- nfd.k8s-sigs.io
|
|
resources:
|
|
- nodefeatures
|
|
verbs:
|
|
- create
|
|
- get
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|