Merge pull request 'Grant deployer StatefulSet rights, for apps with persistent storage' (#2) from toolshed-statefulset-rbac into main

Reviewed-on: http://gitea.100.90.248.118.nip.io/mukul/devops-infra-argo-config/pulls/2
2026-09-09 09:48:43 +00:00
parent dde2622149 3aebc99635
commit 6d3f1643db
1 changed files with 13 additions and 0 deletions
@@ -57,6 +57,19 @@ rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # An app with persistent storage is a StatefulSet instead of a Deployment
  # (internal/deploy.Client.ensureStatefulSet). Delete is needed on both:
  # switching an app between stateless and stateful must remove whichever
  # controller it no longer is, or the two fight over the same pods.
  - apiGroups: ["apps"]
    resources: ["statefulsets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Read-only. The claims themselves are created by the StatefulSet's own
  # volumeClaimTemplates, never directly here — this is only to observe
  # them, and deleting one would destroy an app's data.
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch"]
  # The policy that stops one app reaching another.
  - apiGroups: ["networking.k8s.io"]
    resources: ["networkpolicies"]