chore(rbac): add patch permission for event

Signed-off-by: Rory Z <[email protected]>

Author: Rory-Z

.github/workflows/deploy-docs.yaml

@@ -15,7 +15,7 @@ jobs:
     outputs:
       tags: ${{ steps.tags.outputs.tags}}
 
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     if: ${{ !github.event.release.prerelease }}
 
     steps:
@@ -52,7 +52,7 @@ jobs:
       matrix:
         tags: ${{ fromJSON(needs.prepare.outputs.tags) }}
 
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     if: github.repository_owner == 'emqx'
     steps:
     - name: clone docs

.github/workflows/gitlint.yaml

@@ -4,7 +4,7 @@ on: [pull_request]
 
 jobs:
   gitlint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
         uses: actions/checkout@v4

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.22 AS builder
+FROM golang:1.24 AS builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests

config/rbac/role.yaml

@@ -9,7 +9,6 @@ rules:
   resources:
   - configmaps
   - endpoints
-  - events
   - persistentvolumes
   - secrets
   - services
@@ -19,6 +18,17 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - ""
   resources:

deploy/charts/emqx-operator/Chart.yaml

@@ -15,12 +15,12 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.2.29-beta.1
+version: 2.2.29-beta.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 2.2.29-beta.1
+appVersion: 2.2.29-beta.2
 
 sources:
   - https://github.com/emqx/emqx-operator/tree/main/deploy/charts/emqx-operator

deploy/charts/emqx-operator/templates/controller-manager-rbac.yaml

@@ -51,16 +51,10 @@ rules:
   - ""
   resources:
   - configmaps
-  verbs:
-  - create
-  - get
-  - list
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
   - endpoints
+  - persistentvolumes
+  - secrets
+  - services
   verbs:
   - create
   - get
@@ -75,6 +69,7 @@ rules:
   - create
   - get
   - list
+  - patch
   - update
   - watch
 - apiGroups:
@@ -88,16 +83,6 @@ rules:
   - list
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - persistentvolumes
-  verbs:
-  - create
-  - get
-  - list
-  - update
-  - watch
 - apiGroups:
   - ""
   resources:
@@ -113,40 +98,10 @@ rules:
   - pods/status
   verbs:
   - patch
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - get
-  - list
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - create
-  - get
-  - list
-  - update
-  - watch
 - apiGroups:
   - apps
   resources:
   - replicasets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - update
-  - watch
-- apiGroups:
-  - apps
-  resources:
   - statefulsets
   verbs:
   - create
@@ -155,99 +110,14 @@ rules:
   - list
   - update
   - watch
-- apiGroups:
-  - policy
-  resources:
-  - poddisruptionbudgets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - update
-  - watch
 - apiGroups:
   - apps.emqx.io
   resources:
   - emqxbrokers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - apps.emqx.io
-  resources:
-  - emqxbrokers/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - apps.emqx.io
-  resources:
-  - emqxbrokers/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - apps.emqx.io
-  resources:
   - emqxenterprises
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - apps.emqx.io
-  resources:
-  - emqxenterprises/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - apps.emqx.io
-  resources:
-  - emqxenterprises/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - apps.emqx.io
-  resources:
   - emqxes
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - apps.emqx.io
-  resources:
-  - emqxes/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - apps.emqx.io
-  resources:
-  - emqxes/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - apps.emqx.io
-  resources:
   - emqxplugins
+  - rebalances
   verbs:
   - create
   - delete
@@ -259,49 +129,42 @@ rules:
 - apiGroups:
   - apps.emqx.io
   resources:
+  - emqxbrokers/finalizers
+  - emqxenterprises/finalizers
+  - emqxes/finalizers
   - emqxplugins/finalizers
+  - rebalances/finalizers
   verbs:
   - update
 - apiGroups:
   - apps.emqx.io
   resources:
+  - emqxbrokers/status
+  - emqxenterprises/status
+  - emqxes/status
   - emqxplugins/status
+  - rebalances/status
   verbs:
   - get
   - patch
   - update
 - apiGroups:
-  - apps.emqx.io
+  - coordination.k8s.io
   resources:
-  - rebalances
+  - leases
   verbs:
   - create
-  - delete
   - get
   - list
-  - patch
   - update
   - watch
 - apiGroups:
-  - apps.emqx.io
-  resources:
-  - rebalances/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - apps.emqx.io
-  resources:
-  - rebalances/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - coordination.k8s.io
+  - policy
   resources:
-  - leases
+  - poddisruptionbudgets
   verbs:
   - create
+  - delete
   - get
   - list
   - update

go.mod

@@ -1,6 +1,6 @@
 module github.com/emqx/emqx-operator
 
-go 1.22
+go 1.24
 
 require (
 	emperror.dev/errors v0.8.1

main.go

@@ -63,7 +63,7 @@ func init() {
 }
 
 //+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update
-//+kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;create;update
+//+kubebuilder:rbac:groups="",resources=events,verbs=get;list;watch;create;update;patch
 //+kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=get;list;watch;create;update
 //+kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;watch;create;update;delete
 //+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;update