feat(module): fix roles

Signed-off-by: Pavel Tishkov <[email protected]>
deckhouse · Nov 28, 2024 · 7f02b82 · 7f02b82
1 parent 4fab379
commit 7f02b82
Show file tree

Hide file tree

Showing 9 changed files with 8 additions and 2 deletions.
diff --git a/...lates/rbacv2/manage/manage_internals.yaml → .../manage/permissions/manage_internals.yaml b/...lates/rbacv2/manage/manage_internals.yaml → .../manage/permissions/manage_internals.yaml
@@ -9,7 +9,7 @@ metadata:
     rbac.deckhouse.io/kind: manage
     rbac.deckhouse.io/level: module
     rbac.deckhouse.io/namespace: d8-virtualization
-  name: d8:manage:capability:virtualization:manage_internals
+  name: d8:manage:permission:virtualization:manage_internals
 rules:
 - apiGroups:
   - cdi.internal.virtualization.deckhouse.io

diff --git a/...lates/rbacv2/manage/manage_resources.yaml → .../manage/permissions/manage_resources.yaml b/...lates/rbacv2/manage/manage_resources.yaml → .../manage/permissions/manage_resources.yaml
diff --git a/templates/rbacv2/manage/view_resources.yaml → ...v2/manage/permissions/view_resources.yaml b/templates/rbacv2/manage/view_resources.yaml → ...v2/manage/permissions/view_resources.yaml
diff --git a/templates/rbacv2/manage/roles/manager.yaml b/templates/rbacv2/manage/roles/manager.yaml
@@ -9,7 +9,7 @@ metadata:
     rbac.deckhouse.io/kind: manage
     rbac.deckhouse.io/level: subsystem
     rbac.deckhouse.io/subsystem: virtualization
-    #rbac.deckhouse.io/aggregate-to-virtualization-as: disaster-admin
+    rbac.deckhouse.io/aggregate-to-virtualization-as: super-admin
     rbac.deckhouse.io/aggregate-to-all-as: manager
 aggregationRule:
   clusterRoleSelectors:

diff --git a/templates/rbacv2/use/admin.yaml → templates/rbacv2/use/roles/admin.yaml b/templates/rbacv2/use/admin.yaml → templates/rbacv2/use/roles/admin.yaml
@@ -6,6 +6,7 @@ metadata:
     heritage: deckhouse
     module: virtualization
     rbac.deckhouse.io/aggregate-to-all-as: admin
+    rbac.deckhouse.io/aggregate-to-virtualization-as: super-admin
     rbac.deckhouse.io/kind: use
 aggregationRule:
   clusterRoleSelectors:

diff --git a/templates/rbacv2/use/manager.yaml → templates/rbacv2/use/roles/manager.yaml b/templates/rbacv2/use/manager.yaml → templates/rbacv2/use/roles/manager.yaml
diff --git a/templates/rbacv2/use/super-admin.yaml → templates/rbacv2/use/roles/super-admin.yaml b/templates/rbacv2/use/super-admin.yaml → templates/rbacv2/use/roles/super-admin.yaml
@@ -8,4 +8,9 @@ metadata:
     rbac.deckhouse.io/aggregate-to-role: super-admin
     rbac.deckhouse.io/kind: use
   name: d8:use:virtualization:super-admin
+aggregationRule:
+  clusterRoleSelectors:
+    - matchLabels:
+        rbac.deckhouse.io/kind: use
+        rbac.deckhouse.io/aggregate-to-virtualization-as: super-admin
 rules: []
diff --git a/templates/rbacv2/use/user.yaml → templates/rbacv2/use/roles/user.yaml b/templates/rbacv2/use/user.yaml → templates/rbacv2/use/roles/user.yaml
diff --git a/templates/rbacv2/use/viewer.yaml → templates/rbacv2/use/roles/viewer.yaml b/templates/rbacv2/use/viewer.yaml → templates/rbacv2/use/roles/viewer.yaml