From 79890132a4a1fcc856f4815d7b4f526bbaa971a5 Mon Sep 17 00:00:00 2001
From: Matous Jobanek <mjobanek@redhat.com>
Date: Fri, 20 Sep 2024 17:59:02 +0200
Subject: [PATCH] make sure that registration-service role matches the cache
 (#1089)

---
 .../registration-service.yaml                   | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/deploy/registration-service/registration-service.yaml b/deploy/registration-service/registration-service.yaml
index 999e97402..f4a85ccca 100644
--- a/deploy/registration-service/registration-service.yaml
+++ b/deploy/registration-service/registration-service.yaml
@@ -18,6 +18,10 @@ objects:
       name: registration-service
       namespace: ${NAMESPACE}
     rules:
+# !!! IMPORTANT !!!
+# If there is a new resource added to this role, then revisit the registration-service client cache
+# and make sure that the cache is pre-populated with all resources of this new kind.
+# See: https://github.com/codeready-toolchain/registration-service/blob/36ce810d4c4cd68dc100646e8060ec94ae846f52/cmd/main.go#L192-L204
       - apiGroups:
           - toolchain.dev.openshift.com
         resources:
@@ -31,7 +35,16 @@ objects:
       - apiGroups:
           - toolchain.dev.openshift.com
         resources:
-          - "*"
+          - masteruserrecords
+          - socialevents
+          - spacebindings
+          - spaces
+          - toolchainconfigs
+          - toolchainstatuses
+          - proxyplugins
+          - nstemplatetiers
+          - bannedusers
+          - toolchainclusters
         verbs:
           - get
           - list
@@ -40,11 +53,11 @@ objects:
           - ""
         resources:
           - secrets
-          - configmaps
         verbs:
           - get
           - list
           - watch
+# !!! IMPORTANT - see the comment above !!!
   - kind: RoleBinding
     apiVersion: rbac.authorization.k8s.io/v1
     metadata: