rbac_manifests/svcwatcher-rbac-config.yml

   1 ---
   2 # Copyright 2019 Nokia
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7 #
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 apiVersion: v1
  17 kind: ServiceAccount
  18 metadata:
  19   name: svcwatcher
  20   namespace: kube-system
  21   labels:
  22       kubernetes.io/cluster-service: "true"
  23 ---
  24 apiVersion: rbac.authorization.k8s.io/v1
  25 kind: ClusterRole
  26 metadata:
  27   name: caas:svcwatcher
  28 rules:
  29 - apiGroups:
  30   - ""
  31   resources:
  32   - endpoints
  33   verbs:
  34   - list
  35   - watch
  36   - get
  37   - update
  38   - create
  39   - delete
  40 - apiGroups:
  41   - ""
  42   resources:
  43   - services
  44   - pods
  45   verbs:
  46   - list
  47   - watch
  48   - get
  49 - apiGroups:
  50   - "danm.k8s.io"
  51   resources:
  52   - danmeps
  53   verbs:
  54   - get
  55   - list
  56   - watch
  57   - create
  58   - update
  59   - patch
  60   - delete
  61 - apiGroups:
  62   - ""
  63   resources:
  64   - events
  65   verbs:
  66   - create
  67   - update
  68   - get
  69 ---
  70 apiVersion: rbac.authorization.k8s.io/v1
  71 kind: ClusterRoleBinding
  72 metadata:
  73   name: caas:svcwatcher
  74 roleRef:
  75   apiGroup: rbac.authorization.k8s.io
  76   kind: ClusterRole
  77   name: caas:svcwatcher
  78 subjects:
  79 - kind: ServiceAccount
  80   namespace: kube-system
  81   name: svcwatcher
  82 ---
  83 apiVersion: rbac.authorization.k8s.io/v1
  84 kind: ClusterRoleBinding
  85 metadata:
  86   name: caas:svcwatcher-psp
  87 subjects:
  88 - kind: ServiceAccount
  89   name: svcwatcher
  90   namespace: kube-system
  91 roleRef:
  92   kind: ClusterRole
  93   name: caas:infra-psp
  94   apiGroup: rbac.authorization.k8s.io