Merge pull request #17261 from bparees/ti_controller

Automatic merge from submit-queue (batch tested with PRs 16843, 17095, 17267, 17261, 17274).

fix up template instance controller permissions

fixes #17260

Author: openshift-merge-robot

pkg/cmd/server/bootstrappolicy/controller_policy.go

@@ -156,7 +156,6 @@ func init() {
 		ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + InfraTemplateInstanceControllerServiceAccountName},
 		Rules: []rbac.PolicyRule{
 			rbac.NewRule("create").Groups(kAuthzGroup).Resources("subjectaccessreviews").RuleOrDie(),
-			rbac.NewRule("get", "list", "watch").Groups(templateGroup).Resources("subjectaccessreviews").RuleOrDie(),
 			rbac.NewRule("update").Groups(templateGroup).Resources("templateinstances/status").RuleOrDie(),
 			rbac.NewRule("update").Groups(templateGroup).Resources("templateinstances/finalizers").RuleOrDie(),
 		},

test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml

@@ -3120,14 +3120,6 @@ items:
     - subjectaccessreviews
     verbs:
     - create
-  - apiGroups:
-    - template.openshift.io
-    resources:
-    - subjectaccessreviews
-    verbs:
-    - get
-    - list
-    - watch
   - apiGroups:
     - template.openshift.io
     resources:

test/testdata/bootstrappolicy/bootstrap_policy_file.yaml

@@ -3404,15 +3404,6 @@ items:
     - subjectaccessreviews
     verbs:
     - create
-  - apiGroups:
-    - template.openshift.io
-    attributeRestrictions: null
-    resources:
-    - subjectaccessreviews
-    verbs:
-    - get
-    - list
-    - watch
   - apiGroups:
     - template.openshift.io
     attributeRestrictions: null