From adb4f559bbee731edde2fe5b13accbacedcf59fb Mon Sep 17 00:00:00 2001
From: Matthias Wessendorf <mwessend@redhat.com>
Date: Mon, 14 Jun 2021 08:59:30 +0200
Subject: [PATCH] :dizzy: Add permission to update namespace finalizer

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>
---
 config/core/roles/webhook-clusterrole.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/config/core/roles/webhook-clusterrole.yaml b/config/core/roles/webhook-clusterrole.yaml
index 68c45c3995d..92d30b4939e 100644
--- a/config/core/roles/webhook-clusterrole.yaml
+++ b/config/core/roles/webhook-clusterrole.yaml
@@ -42,6 +42,14 @@ rules:
       - "watch"
       - "patch"
 
+  # finalizers are needed for the owner reference of the webhook
+  - apiGroups:
+      - ""
+    resources:
+      - "namespaces/finalizers"
+    verbs:
+      - "update"
+
   # For getting our Deployment so we can decorate with ownerref.
   - apiGroups:
       - "apps"