[RFC-0010] Add RBAC for creating service account tokens

Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2026-02-06 10:55:56 +00:00 · 2025-05-03 02:07:03 +01:00
parent a6b5013649
commit 941af6a648
1 changed files with 7 additions and 0 deletions
--- a/manifests/rbac/controller.yaml
+++ b/manifests/rbac/controller.yaml
@@ -69,6 +69,13 @@ rules:
  - update
  - patch
  - delete
+# required for object-level workload identity
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 # required for flow control
 - nonResourceURLs:
  - /livez/ping