Merge pull request #195 from DharmitD/mcad-roles

Add RBAC rules for mcad and ray roles

config/rbac/role.yaml

@@ -154,6 +154,16 @@ rules:
   - seldondeployments
   verbs:
   - '*'
+- apiGroups:
+  - mcad.ibm.com
+  resources:
+  - appwrappers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
 - apiGroups:
   - monitoring.coreos.com
   resources:
@@ -178,6 +188,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ray.io
+  resources:
+  - rayclusters
+  - rayjobs
+  - rayservices
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
@@ -229,25 +251,3 @@ rules:
   - '*'
   verbs:
   - '*'
-- apiGroups:
-    - mcad.ibm.com
-  resources:
-    - appwrappers
-  verbs:
-    - create
-    - get
-    - list
-    - patch
-    - delete
-- apiGroups:
-    - ray.io
-  resources:
-    - rayclusters
-    - rayjobs
-    - rayservices
-  verbs:
-    - create
-    - get
-    - list
-    - patch
-    - delete

controllers/dspipeline_controller.go

@@ -142,6 +142,8 @@ func (r *DSPAReconciler) buildCondition(conditionType string, dspa *dspav1alpha1
 //+kubebuilder:rbac:groups=machinelearning.seldon.io,resources=seldondeployments,verbs=*
 //+kubebuilder:rbac:groups=tekton.dev,resources=*,verbs=*
 //+kubebuilder:rbac:groups=custom.tekton.dev,resources=pipelineloops,verbs=*
+//+kubebuilder:rbac:groups=mcad.ibm.com,resources=appwrappers,verbs=create;get;list;patch;delete
+//+kubebuilder:rbac:groups=ray.io,resources=rayclusters;rayjobs;rayservices,verbs=create;get;list;patch;delete
 //+kubebuilder:rbac:groups=authorization.k8s.io,resources=subjectaccessreviews,verbs=create
 //+kubebuilder:rbac:groups=authentication.k8s.io,resources=tokenreviews,verbs=create
 //+kubebuilder:rbac:groups=image.openshift.io,resources=imagestreamtags,verbs=get