add rbac and env POD_NAME to fix incorrect event refobject (#293)

Signed-off-by: Zhiwei Yin <[email protected]>
stolostron · Sep 13, 2023 · 8d77b40 · 8d77b40
1 parent 83b79e5
commit 8d77b40
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/pkg/bootstrap/manifests/klusterlet/cluster_role.yaml b/pkg/bootstrap/manifests/klusterlet/cluster_role.yaml
@@ -6,6 +6,13 @@ rules:
 - apiGroups: [""]
   resources: ["secrets", "configmaps", "serviceaccounts"]
   verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
+# get pods and replicasets is for event creation
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get"]
+- apiGroups: [ "apps" ]
+  resources: [ "replicasets" ]
+  verbs: [ "get" ]
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs: ["create", "get", "list", "update", "watch", "patch"]

diff --git a/pkg/bootstrap/manifests/klusterlet/operator.yaml b/pkg/bootstrap/manifests/klusterlet/operator.yaml
@@ -46,6 +46,11 @@ spec:
           - "/registration-operator"
           - "klusterlet"
           - "--disable-leader-election"
+        env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
         securityContext:
           allowPrivilegeEscalation: false
           capabilities: