From 56506b5a47f10bcfc43b526fc24569c31981060b Mon Sep 17 00:00:00 2001
From: Maidul Islam <maidul98@gmail.com>
Date: Fri, 14 Jun 2024 10:57:08 -0400
Subject: [PATCH] Add missing RBAC to k8s Missing RBAC for service accounts

---
 helm-charts/secrets-operator/templates/manager-rbac.yaml | 8 ++++++++
 k8-operator/config/rbac/role.yaml                        | 8 ++++++++
 k8-operator/config/samples/k8s-auth/sample.yaml          | 2 +-
 k8-operator/controllers/infisicalsecret_controller.go    | 2 +-
 4 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/helm-charts/secrets-operator/templates/manager-rbac.yaml b/helm-charts/secrets-operator/templates/manager-rbac.yaml
index 758bc7dfe..ca6fd36e1 100644
--- a/helm-charts/secrets-operator/templates/manager-rbac.yaml
+++ b/helm-charts/secrets-operator/templates/manager-rbac.yaml
@@ -27,6 +27,14 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
diff --git a/k8-operator/config/rbac/role.yaml b/k8-operator/config/rbac/role.yaml
index 68ea375b7..10c2af414 100644
--- a/k8-operator/config/rbac/role.yaml
+++ b/k8-operator/config/rbac/role.yaml
@@ -27,6 +27,14 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
diff --git a/k8-operator/config/samples/k8s-auth/sample.yaml b/k8-operator/config/samples/k8s-auth/sample.yaml
index 6dcbae13a..44f2d86ee 100644
--- a/k8-operator/config/samples/k8s-auth/sample.yaml
+++ b/k8-operator/config/samples/k8s-auth/sample.yaml
@@ -12,7 +12,7 @@ spec:
     authentication:
         # Native Kubernetes Auth
         kubernetesAuth:
-            identityId: <>
+            identityId: 8c0c9823-7249-4043-b292-a861fb9b1b50
             serviceAccountRef:
               name: infisical-auth
               namespace: default
diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go
index 73da45034..2078341d8 100644
--- a/k8-operator/controllers/infisicalsecret_controller.go
+++ b/k8-operator/controllers/infisicalsecret_controller.go
@@ -28,6 +28,7 @@ type InfisicalSecretReconciler struct {
 //+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;delete
 //+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;delete
 //+kubebuilder:rbac:groups=apps,resources=deployments,verbs=list;watch;get;update
+//+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.
@@ -75,7 +76,6 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	err := r.Get(ctx, req.NamespacedName, &infisicalSecretCR)
 	if err != nil {
 		if errors.IsNotFound(err) {
-			fmt.Printf("\nInfisical Secret CRD not found [err=%v]", err)
 			return ctrl.Result{
 				Requeue: false,
 			}, nil