feat: 接入 Instance 原生管理观测与删除保护

config/manager/manager.yaml

@@ -65,6 +65,11 @@ spec:
           - --health-probe-bind-address=:8081
         image: controller:latest
         name: manager
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
         ports:
         - containerPort: 8081
           name: health

config/rbac/database_credentials_role.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: database-management-credentials
+  namespace: system
+rules:
+- apiGroups: [""]
+  resources: [secrets]
+  verbs: [get, list, watch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: database-management-credentials
+  namespace: system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: database-management-credentials
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system

config/rbac/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
 - service_account.yaml
 - role.yaml
 - role_binding.yaml
+- database_credentials_role.yaml
 - leader_election_role.yaml
 - leader_election_role_binding.yaml
 # The following RBAC configurations are used to protect

config/rbac/role.yaml

@@ -19,6 +19,7 @@ rules:
   - database.ayatori.ddupan.top
   resources:
   - postgresqldatabases/finalizers
+  - postgresqlinstances/finalizers
   - postgresqltenants/finalizers
   verbs:
   - update
@@ -26,6 +27,7 @@ rules:
   - database.ayatori.ddupan.top
   resources:
   - postgresqldatabases/status
+  - postgresqlinstances/status
   - postgresqltenants/status
   verbs:
   - get
@@ -35,13 +37,6 @@ rules:
   - database.ayatori.ddupan.top
   resources:
   - postgresqlinstances
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - database.ayatori.ddupan.top
-  resources:
   - postgresqltenants
   verbs:
   - get