Grant OLM operator permissions to manage cert-manager certificates

This is required when setting `method: certmanager` for some Cilium TLS configuration (e.g. Hubble TLS).
projectsyn · Jan 14, 2025 · e9aec15 · e9aec15
1 parent f8b6463
commit e9aec15
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 0 deletions.
diff --git a/component/olm.jsonnet b/component/olm.jsonnet
@@ -213,6 +213,24 @@ local patchManifests = function(file, has_csv)
           else
             r
           for r in super.rules
+        ] + [
+          // Grant OLM operator permission to manage cert-manager certificate
+          // resources. This is required when setting `method: certmanager`
+          // for some Cilium TLS configuration (e.g. Hubble TLS).
+          {
+            apiGroups: [ 'cert-manager.io' ],
+            resources: [ 'certificates' ],
+            verbs: [
+              'create',
+              'delete',
+              'deletecollection',
+              'get',
+              'list',
+              'patch',
+              'update',
+              'watch',
+            ],
+          },
         ],
       },
     }

diff --git a/...den/olm-opensource/cilium/cilium/olm/cluster-network-06-cilium-00005-cilium-olm-role.yaml b/...den/olm-opensource/cilium/cilium/olm/cluster-network-06-cilium-00005-cilium-olm-role.yaml
@@ -65,3 +65,16 @@ rules:
       - servicemonitors
     verbs:
       - '*'
+  - apiGroups:
+      - cert-manager.io
+    resources:
+      - certificates
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - get
+      - list
+      - patch
+      - update
+      - watch