actions-runner-controller/config/rbac/role.yaml


---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: manager-role
rules:
- apiGroups:
  - actions.summerwind.dev
  resources:
  - horizontalrunnerautoscalers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - horizontalrunnerautoscalers/finalizers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - horizontalrunnerautoscalers/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnerdeployments
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnerdeployments/finalizers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnerdeployments/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnerreplicasets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnerreplicasets/finalizers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnerreplicasets/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runners
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runners/finalizers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runners/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnersets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnersets/finalizers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - actions.summerwind.dev
  resources:
  - runnersets/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - apps
  resources:
  - statefulsets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - apps
  resources:
  - statefulsets/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - list
  - update
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - pods/finalizers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
Implement runner controller 2020-01-28 21:58:01 +09:00
			`---`
			`apiVersion: rbac.authorization.k8s.io/v1`
			`kind: ClusterRole`
			`metadata:`
			`creationTimestamp: null`
			`name: manager-role`
			`rules:`
feat: Use HorizontalRunnerAutoscaler for autoscaling 2020-07-19 18:42:06 +09:00			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
			`- horizontalrunnerautoscalers`
Ensure controller-gen is up-to-date and the code and the manifests are in-sync Follow-up for #95 that added /finalizers subresource permission and #103 that upgraded controller-gen from 0.2.4 from 0.3.0 2020-10-06 09:23:03 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
Allowing access to finalizers for all managed resources (#95) 2020-10-04 20:12:01 -04:00			`- horizontalrunnerautoscalers/finalizers`
feat: Use HorizontalRunnerAutoscaler for autoscaling 2020-07-19 18:42:06 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
			`- horizontalrunnerautoscalers/status`
			`verbs:`
			`- get`
			`- patch`
			`- update`
feat: RunnerDeployment Adds the initial version of RunnerDeployment that is intended to manage RunnerSets(#1), like Deployment manages ReplicaSets. This is the initial version and therefore is bare bone. The only update strategy it supports is `Recreate`, which recreates the underlying RunnerSet when the runner template changes. I'd like to add `RollingUpdate` strategy once this is merged. This depends on #1 so the diff contains that of #1, too. Please see only the latest commit for review. Also see https://github.com/mumoshu/actions-runner-controller-ci/runs/471329823?check_suite_focus=true to confirm that `make tests` is passing after changes made in this commit. 2020-02-26 21:23:23 +09:00			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
			`- runnerdeployments`
Ensure controller-gen is up-to-date and the code and the manifests are in-sync Follow-up for #95 that added /finalizers subresource permission and #103 that upgraded controller-gen from 0.2.4 from 0.3.0 2020-10-06 09:23:03 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
Allowing access to finalizers for all managed resources (#95) 2020-10-04 20:12:01 -04:00			`- runnerdeployments/finalizers`
feat: RunnerDeployment Adds the initial version of RunnerDeployment that is intended to manage RunnerSets(#1), like Deployment manages ReplicaSets. This is the initial version and therefore is bare bone. The only update strategy it supports is `Recreate`, which recreates the underlying RunnerSet when the runner template changes. I'd like to add `RollingUpdate` strategy once this is merged. This depends on #1 so the diff contains that of #1, too. Please see only the latest commit for review. Also see https://github.com/mumoshu/actions-runner-controller-ci/runs/471329823?check_suite_focus=true to confirm that `make tests` is passing after changes made in this commit. 2020-02-26 21:23:23 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
			`- runnerdeployments/status`
			`verbs:`
			`- get`
			`- patch`
			`- update`
Implement runner controller 2020-01-28 21:58:01 +09:00			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
Fix RBAC role for RunnerDeployment and RunnerReplicaSet 2020-03-15 18:08:11 +09:00			`- runnerreplicasets`
Ensure controller-gen is up-to-date and the code and the manifests are in-sync Follow-up for #95 that added /finalizers subresource permission and #103 that upgraded controller-gen from 0.2.4 from 0.3.0 2020-10-06 09:23:03 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
Allowing access to finalizers for all managed resources (#95) 2020-10-04 20:12:01 -04:00			`- runnerreplicasets/finalizers`
Implement runner controller 2020-01-28 21:58:01 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
Fix RBAC role for RunnerDeployment and RunnerReplicaSet 2020-03-15 18:08:11 +09:00			`- runnerreplicasets/status`
Implement runner controller 2020-01-28 21:58:01 +09:00			`verbs:`
			`- get`
			`- patch`
			`- update`
feat: RunnerSets RunnerSet is basically ReplicaSet for Runners. It is responsible for maintaining number of runners to match the desired one. That is, it creates missing runners from `.Spec.Template` and deletes redundant runners. Similar to ReplicaSet, this does not support rolling update of runners on its own. We might want to later add `RunnerDeployment` for that. But that's another story. 2020-02-21 03:01:52 +09:00			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
Fix RBAC role for RunnerDeployment and RunnerReplicaSet 2020-03-15 18:08:11 +09:00			`- runners`
Ensure controller-gen is up-to-date and the code and the manifests are in-sync Follow-up for #95 that added /finalizers subresource permission and #103 that upgraded controller-gen from 0.2.4 from 0.3.0 2020-10-06 09:23:03 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
Allowing access to finalizers for all managed resources (#95) 2020-10-04 20:12:01 -04:00			`- runners/finalizers`
feat: RunnerSets RunnerSet is basically ReplicaSet for Runners. It is responsible for maintaining number of runners to match the desired one. That is, it creates missing runners from `.Spec.Template` and deletes redundant runners. Similar to ReplicaSet, this does not support rolling update of runners on its own. We might want to later add `RunnerDeployment` for that. But that's another story. 2020-02-21 03:01:52 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
Fix RBAC role for RunnerDeployment and RunnerReplicaSet 2020-03-15 18:08:11 +09:00			`- runners/status`
feat: RunnerSets RunnerSet is basically ReplicaSet for Runners. It is responsible for maintaining number of runners to match the desired one. That is, it creates missing runners from `.Spec.Template` and deletes redundant runners. Similar to ReplicaSet, this does not support rolling update of runners on its own. We might want to later add `RunnerDeployment` for that. But that's another story. 2020-02-21 03:01:52 +09:00			`verbs:`
			`- get`
			`- patch`
			`- update`
feat: RunnerSet backed by StatefulSet (#629) * feat: RunnerSet backed by StatefulSet Unlike a runner deployment, a runner set can manage a set of stateful runners by combining a statefulset and an admission webhook that mutates statefulset-managed pods with required envvars and registration tokens. Resolves #613 Ref #612 * Upgrade controller-runtime to 0.9.0 * Bump Go to 1.16.x following controller-runtime 0.9.0 * Upgrade kubebuilder to 2.3.2 for updated etcd and apiserver following local setup * Fix startup failure due to missing LeaderElectionID * Fix the issue that any pods become unable to start once actions-runner-controller got failed after the mutating webhook has been registered * Allow force-updating statefulset * Fix runner container missing work and certs-client volume mounts and DOCKER_HOST and DOCKER_TLS_VERIFY envvars when dockerdWithinRunner=false * Fix runnerset-controller not applying statefulset.spec.template.spec changes when there were no changes in runnerset spec * Enable running acceptance tests against arbitrary kind cluster * RunnerSet supports non-ephemeral runners only today * fix: docker-build from root Makefile on intel mac * fix: arch check fixes for mac and ARM * ci: aligning test data format and patching checks * fix: removing namespace in test data * chore: adding more ignores * chore: removing leading space in shebang * Re-add metrics to org hra testdata * Bump cert-manager to v1.1.1 and fix deploy.sh Co-authored-by: toast-gear <15716903+toast-gear@users.noreply.github.com> Co-authored-by: Callum James Tait <callum.tait@photobox.com> 2021-06-22 17:10:09 +09:00			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
			`- runnersets`
			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
			`- runnersets/finalizers`
			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- actions.summerwind.dev`
			`resources:`
			`- runnersets/status`
			`verbs:`
			`- get`
			`- patch`
			`- update`
			`- apiGroups:`
			`- apps`
			`resources:`
			`- statefulsets`
			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- apps`
			`resources:`
			`- statefulsets/status`
			`verbs:`
			`- get`
			`- patch`
			`- update`
			`- apiGroups:`
			`- coordination.k8s.io`
			`resources:`
			`- leases`
			`verbs:`
			`- create`
			`- get`
			`- list`
			`- update`
Add permission to create/patch events resource 2020-03-27 23:25:37 +09:00			`- apiGroups:`
			`- ""`
			`resources:`
			`- events`
			`verbs:`
			`- create`
			`- patch`
Update CRD validation and RBAC 2020-02-02 10:30:42 +09:00			`- apiGroups:`
			`- ""`
			`resources:`
Fix permission for pods 2020-02-02 19:49:10 +09:00			`- pods`
Ensure controller-gen is up-to-date and the code and the manifests are in-sync Follow-up for #95 that added /finalizers subresource permission and #103 that upgraded controller-gen from 0.2.4 from 0.3.0 2020-10-06 09:23:03 +09:00			`verbs:`
			`- create`
			`- delete`
			`- get`
			`- list`
			`- patch`
			`- update`
			`- watch`
			`- apiGroups:`
			`- ""`
			`resources:`
Allowing access to finalizers for all managed resources (#95) 2020-10-04 20:12:01 -04:00			`- pods/finalizers`
Update CRD validation and RBAC 2020-02-02 10:30:42 +09:00			`verbs:`
Fix permission for pods 2020-02-02 19:49:10 +09:00			`- create`
Update CRD validation and RBAC 2020-02-02 10:30:42 +09:00			`- delete`
			`- get`
Fix permission for pods 2020-02-02 19:49:10 +09:00			`- list`
Update CRD validation and RBAC 2020-02-02 10:30:42 +09:00			`- patch`
			`- update`
Fix permission for pods 2020-02-02 19:49:10 +09:00			`- watch`