Merge pull request #13280 from miminar/allow-registry-to-get-isi-again

Merged by openshift-bot

Author: OpenShift Bot

pkg/cmd/server/bootstrappolicy/policy.go

@@ -664,7 +664,7 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {
 				authorizationapi.NewRule("list").Groups(kapiGroup).Resources("limitranges", "resourcequotas").RuleOrDie(),
 
 				authorizationapi.NewRule("get", "delete").Groups(imageGroup).Resources("images", "imagestreamtags").RuleOrDie(),
-				authorizationapi.NewRule("get").Groups(imageGroup).Resources("imagestreams/secrets").RuleOrDie(),
+				authorizationapi.NewRule("get").Groups(imageGroup).Resources("imagestreamimages", "imagestreams/secrets").RuleOrDie(),
 				authorizationapi.NewRule("get", "update").Groups(imageGroup).Resources("images", "imagestreams").RuleOrDie(),
 				authorizationapi.NewRule("create").Groups(imageGroup).Resources("imagestreammappings").RuleOrDie(),
 			},

test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml

@@ -1991,6 +1991,7 @@ items:
     - ""
     attributeRestrictions: null
     resources:
+    - imagestreamimages
     - imagestreams/secrets
     verbs:
     - get