<p>I am new to the Kubernetes world but some time ago I developed a Kubernetes operator using OperatorSDK and Golang. I was using cluster-admin role for running the operator pod but now I want to reduce the resources the operator can work with.</p>
<p>It there some tool that can scan the code of the operator and generate an appropriate clusterrole? Or is there some clever way to find what resources are used by the operator?</p>

aliench0
<p>Assuming that you need to add privileges to your clusterrole because your controller is reconciling Kubernetes workloads itself, you could use the operator-builder project (see <a href="https://github.com/vmware-tanzu-labs/operator-builder" rel="nofollow noreferrer">https://github.com/vmware-tanzu-labs/operator-builder</a>) to do it for you.  The code that does this automatically for you is found at <a href="https://github.com/vmware-tanzu-labs/operator-builder/blob/main/internal/workload/v1/rbac.go#L104" rel="nofollow noreferrer">https://github.com/vmware-tanzu-labs/operator-builder/blob/main/internal/workload/v1/rbac.go#L104</a> .</p>
<p>The pattern from OperatorSDK will be familiar to what you are currently doing as OperatorSDK and Operator Builder are both plugins to Kubebuilder, and thus follow similar patterns (e.g. <code>&lt;command&gt; init &lt;args&gt;</code> and <code>&lt;command&gt; create api &lt;args&gt;</code>.</p>
<p><strong>EXAMPLE:</strong></p>
<p>Your config (project-specific construct) would look like this:</p>
<pre class="lang-yaml prettyprint-override"><code>name: webstore
kind: StandaloneWorkload
spec:
  api:
    domain: acme.com
    group: apps
    version: v1alpha1
    kind: WebStore
    clusterScoped: false
  resources:
  - resources.yaml
</code></pre>
<p>Basically your input (<code>resources.yaml</code> from the above config) would be something like this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: webstore-deploy
spec:
  replicas: 2  # +operator-builder:field:name=webStoreReplicas,default=2,type=int
  selector:
    matchLabels:
      app: webstore
  template:
    metadata:
      labels:
        app: webstore
    spec:
      containers:
      - name: webstore-container
        #+operator-builder:field:name=webstoreImage,default=&quot;nginx:1.17&quot;,type=string,description=&quot;Defines the web store image&quot;
        image: nginx:1.17
        ports:
        - containerPort: 8080
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: webstore-ing
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: app.acme.com
    http:
      paths:
      - path: /
        backend:
          serviceName: webstorep-svc
          servicePort: 80
---
kind: Service
apiVersion: v1
metadata:
  name: webstore-svc # +operator-builder:field:name=serviceName,type=string,default=&quot;webstore-svc&quot;
spec:
  selector:
    app: webstore
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
</code></pre>
<p>Running the following commands:</p>
<pre class="lang-sh prettyprint-override"><code>operator-builder init \
    --workload-config &lt;path_to_config&gt; \
    --repo github.com/acme/acme-cnp-mgr \
    --skip-go-version-check

operator-builder create \
create api \
    --workload-config &lt;path_to_config&gt; \
    --controller \
    --resource
</code></pre>
<p>Your output would be something like (in the controller file):</p>
<pre class="lang-golang prettyprint-override"><code>// +kubebuilder:rbac:groups=apps.acme.com,resources=webstores,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=apps.acme.com,resources=webstores/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete
</code></pre>
<p>When you run the <code>make manifests</code> command, your RBAC is generated based upon the correct Kubebuilder markers.</p>
<p><strong>DISCLAIMER:</strong> I am a key contributor to the project and of course think that this will be helpful to automate the generation of RBAC markers. :)</p>
