OADP 486 - Update velero service account permissions (#673) (#682)

* OADP 486 - Update velero service account permissions

* Add back velero-privileged

(cherry picked from commit 3612b14)

Author: dymurray

bundle/manifests/oadp-operator.clusterserviceversion.yaml

@@ -421,8 +421,41 @@ spec:
           serviceAccountName: openshift-adp-controller-manager
         - rules:
             - apiGroups:
+                - build.openshift.io
+                - migration.openshift.io
+                - rbac.authorization.k8s.io
+                - velero.io
+              resources:
+                - '*'
+              verbs:
                 - '*'
+            - apiGroups:
+                - ""
               resources:
+                - serviceaccounts
+              verbs:
+                - '*'
+            - apiGroups:
+                - packages.operators.coreos.com
+              resources:
+                - packagemanifests
+              verbs:
+                - '*'
+            - apiGroups:
+                - '*'
+              resources:
+                - '*'
+              verbs:
+                - get
+                - watch
+                - list
+                - update
+                - patch
+                - create
+                - delete
+                - assign
+                - deletecollection
+            - nonResourceURLs:
                 - '*'
               verbs:
                 - '*'

config/velero/velero-role.yaml

@@ -7,16 +7,48 @@ metadata:
   name: velero-role
 rules:
 - apiGroups:
+  - build.openshift.io
+  - migration.openshift.io
+  - rbac.authorization.k8s.io
+  - velero.io
+  resources:
+  - '*'
+  verbs:
+  - '*'
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
   - '*'
+- apiGroups:
+  - packages.operators.coreos.com
   resources:
+  - packagemanifests
+  verbs:
+  - '*'
+- apiGroups:
+  - '*'
+  resources:
+  - '*'
+  verbs:
+  - get
+  - watch
+  - list
+  - update
+  - patch
+  - create
+  - delete
+  - assign
+  - deletecollection
+- nonResourceURLs:
   - '*'
   verbs:
   - '*'
 - apiGroups:
   - security.openshift.io
   resourceNames:
   - privileged
-  - velero-privileged
   resources:
   - securitycontextconstraints
   verbs: