Add build by type resource permissions to build controller policy

openshift · Jan 13, 2016 · 8bcf43d · 8bcf43d
1 parent 97364a6
commit 8bcf43d
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/pkg/cmd/server/bootstrappolicy/infra_sa_policy.go b/pkg/cmd/server/bootstrappolicy/infra_sa_policy.go
@@ -98,6 +98,11 @@ func init() {
 					Verbs:     sets.NewString("update"),
 					Resources: sets.NewString("builds"),
 				},
+				// Create permission on virtual build type resources allows builds of those types to be updated
+				{
+					Verbs:     sets.NewString("create"),
+					Resources: sets.NewString("builds/docker", "builds/source", "builds/custom"),
+				},
 				// BuildController.ImageStreamClient (ControllerClient)
 				{
 					Verbs:     sets.NewString("get"),

diff --git a/test/fixtures/bootstrappolicy/bootstrap_cluster_roles.yaml b/test/fixtures/bootstrappolicy/bootstrap_cluster_roles.yaml
@@ -968,6 +968,14 @@ items:
     - builds
     verbs:
     - update
+  - apiGroups: null
+    attributeRestrictions: null
+    resources:
+    - builds/custom
+    - builds/docker
+    - builds/source
+    verbs:
+    - create
   - apiGroups: null
     attributeRestrictions: null
     resources: