Adding Broker read permissions

[nachocano]

Proposed Changes

• Adding read only permissions to brokers.
• This should be merged right after Broker, Trigger, and Namespace Controllers eventing#788, otherwise pointing sources to brokers won't work.

Release Note

NONE

[evankanderson]

Do you also need to update:

https://github.com/knative/eventing-sources/blob/master/contrib/gcppubsub/config/201-clusterrole.yaml
https://github.com/knative/eventing-sources/blob/master/contrib/camel/config/201-clusterrole.yaml

[nachocano]

Do you also need to update:

https://github.com/knative/eventing-sources/blob/master/contrib/gcppubsub/config/201-clusterrole.yaml
https://github.com/knative/eventing-sources/blob/master/contrib/camel/config/201-clusterrole.yaml

Thanks! Done

[evankanderson]

/lgtm
/approve

I think we might only need

resources:
- channels/status
- brokers/status

But it seems fine to start with this and test the other later.

[knative-prow-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: evankanderson, nachocano

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [evankanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[matzew]

👍

[Harwayne]

/lgtm

[Harwayne]

This might be a good case for Aggregated ClusterRole.

Essentially, we label ClusterRoles that are needed to for resolving Addressables, then all ServiceAccounts that need to resolve Addressables simply get the aggregated role. Then any updates just need to be made in one place and suddenly all ServiceAccounts have the correct permissions.

[Harwayne]

This might be a good case for Aggregated ClusterRole.

Essentially, we label ClusterRoles that are needed to for resolving Addressables, then all ServiceAccounts that need to resolve Addressables simply get the aggregated role. Then any updates just need to be made in one place and suddenly all ServiceAccounts have the correct permissions.

Created knative/eventing#916 to track this idea.

[evankanderson]

You need to remove the "[WIP]" from the title when you want Prow to merge this.

[nachocano]

You need to remove the "[WIP]" from the title when you want Prow to merge this.

Done! Thanks @evankanderson, my bad.