ce7cb702218693d08ea6d83464d2457c9250027c

services/mirrored-image/k8s/rbac.yaml

@@ -0,0 +1,53 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: mirrored-image
+  namespace: mirrored-image
+rules:
+  - apiGroups: [mirror.quorate.dev]
+    resources: [mirroredimages]
+    verbs: [get, list, watch]
+  - apiGroups: [mirror.quorate.dev]
+    resources: [mirroredimages/status]
+    verbs: [get, patch, update]
+  - apiGroups: [argoproj.io]
+    resources: [workflows]
+    verbs: [create, get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: mirrored-image
+  namespace: mirrored-image
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: mirrored-image
+subjects:
+  - kind: ServiceAccount
+    name: mirrored-image
+    namespace: mirrored-image
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: workflow-exec
+  namespace: mirrored-image
+rules:
+  - apiGroups: [argoproj.io]
+    resources: [workflowtaskresults]
+    verbs: [create, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: workflow-exec
+  namespace: mirrored-image
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: workflow-exec
+subjects:
+  - {kind: ServiceAccount, name: candidate-exec}
+  - {kind: ServiceAccount, name: promote-exec}
+  - {kind: ServiceAccount, name: cleanup-exec}