Add hostendpoints get and list to tigera ui and admin users (#3484)

This changeset adds `hostendpoints` get and list rbac for the built-in `tigera-ui-user` and `tigera-network-admin` users.
tigera · Aug 30, 2024 · dcb21df · dcb21df
1 parent 6eeefb1
commit dcb21df
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/pkg/render/apiserver.go b/pkg/render/apiserver.go
@@ -1485,6 +1485,12 @@ func (c *apiServerComponent) tigeraUserClusterRole() *rbacv1.ClusterRole {
 			Resources: []string{"clusterinformations"},
 			Verbs:     []string{"get", "list"},
 		},
+		// Access to hostendpoints from the UI ServiceGraph.
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{"hostendpoints"},
+			Verbs:     []string{"get", "list"},
+		},
 		// List and view the threat defense configuration
 		{
 			APIGroups: []string{"projectcalico.org"},
@@ -1664,6 +1670,12 @@ func (c *apiServerComponent) tigeraNetworkAdminClusterRole() *rbacv1.ClusterRole
 			Resources: []string{"clusterinformations"},
 			Verbs:     []string{"get", "list"},
 		},
+		// Access to hostendpoints from the UI ServiceGraph.
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{"hostendpoints"},
+			Verbs:     []string{"get", "list"},
+		},
 		// Manage the threat defense configuration
 		{
 			APIGroups: []string{"projectcalico.org"},

diff --git a/pkg/render/apiserver_test.go b/pkg/render/apiserver_test.go
@@ -1306,6 +1306,11 @@ var (
 			Resources: []string{"clusterinformations"},
 			Verbs:     []string{"get", "list"},
 		},
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{"hostendpoints"},
+			Verbs:     []string{"get", "list"},
+		},
 		{
 			APIGroups: []string{"projectcalico.org"},
 			Resources: []string{
@@ -1445,6 +1450,11 @@ var (
 			Resources: []string{"clusterinformations"},
 			Verbs:     []string{"get", "list"},
 		},
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{"hostendpoints"},
+			Verbs:     []string{"get", "list"},
+		},
 		{
 			APIGroups: []string{"projectcalico.org"},
 			Resources: []string{