From 4e7571b672648fb8734c61d8228cdd8d9ea3986e Mon Sep 17 00:00:00 2001 From: Stefan Peknik Date: Wed, 16 Sep 2026 23:19:55 +0200 Subject: [PATCH] fix(rbac): add aggregation labels to ObjectStore ClusterRoles Add standard Kubernetes RBAC aggregation labels so that users bound to the built-in admin, edit, or view ClusterRoles can access ObjectStore resources without manual RoleBindings. Closes #1102 Signed-off-by: Stefan Peknik --- config/rbac/objectstore_editor_role.yaml | 2 ++ config/rbac/objectstore_viewer_role.yaml | 1 + 2 files changed, 3 insertions(+) diff --git a/config/rbac/objectstore_editor_role.yaml b/config/rbac/objectstore_editor_role.yaml index 418ad0d8..80a23657 100644 --- a/config/rbac/objectstore_editor_role.yaml +++ b/config/rbac/objectstore_editor_role.yaml @@ -5,6 +5,8 @@ metadata: labels: app.kubernetes.io/name: plugin-barman-cloud app.kubernetes.io/managed-by: kustomize + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" name: barman-plugin-objectstore-editor-role rules: - apiGroups: diff --git a/config/rbac/objectstore_viewer_role.yaml b/config/rbac/objectstore_viewer_role.yaml index 26c051a5..143d3e6d 100644 --- a/config/rbac/objectstore_viewer_role.yaml +++ b/config/rbac/objectstore_viewer_role.yaml @@ -5,6 +5,7 @@ metadata: labels: app.kubernetes.io/name: plugin-barman-cloud app.kubernetes.io/managed-by: kustomize + rbac.authorization.k8s.io/aggregate-to-view: "true" name: barman-plugin-objectstore-viewer-role rules: - apiGroups: