restrict rbac

linode · May 13, 2024 · 4d2109e · 4d2109e
1 parent 1d2e979
commit 4d2109e
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/deploy/chart/templates/clusterrole-rbac.yaml b/deploy/chart/templates/clusterrole-rbac.yaml
@@ -32,6 +32,9 @@ rules:
     verbs: ["get", "watch", "list", "update", "patch"]
 {{- if .Values.sharedIPLoadBalancing }}
   - apiGroups: ["cilium.io"]
-    resources: ["ciliumloadbalancerippools", "ciliumbgppeeringpolicies"]
+    resources: ["ciliumloadbalancerippools"]
     verbs: ["get", "watch", "list", "update", "create", "delete"]
+  - apiGroups: ["cilium.io"]
+    resources: ["ciliumbgppeeringpolicies"]
+    verbs: ["get", "watch", "list", "create"]
 {{- end }}