Give default organization controller permissions to create/update arb…

…itrary users
appuio · Sep 25, 2024 · 2654189 · 2654189
1 parent 9fb0488
commit 2654189
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/config/rbac/controller/role.yaml b/config/rbac/controller/role.yaml
@@ -179,6 +179,14 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - rbac.appuio.io
+  resources:
+  - users
+  verbs:
+  - create
+  - patch
+  - update
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

diff --git a/controllers/default_organization_controller.go b/controllers/default_organization_controller.go
@@ -24,7 +24,8 @@ type DefaultOrganizationReconciler struct {
 }
 
 //+kubebuilder:rbac:groups=appuio.io,resources=organizationmembers,verbs=get;list;watch
-//+kubebuilder:rbac:groups=appuio.io,resources=users,verbs=get;list;watch;update;patch
+//+kubebuilder:rbac:groups=appuio.io,resources=users,verbs=get;list;watch
+//+kubebuilder:rbac:groups=rbac.appuio.io,resources=users,verbs=create;update;patch
 //+kubebuilder:rbac:groups=appuio.io,resources=users/status,verbs=get
 
 // Reconcile reacts on changes of memberships and sets members' default organization if appropriate