ce7cb702218693d08ea6d83464d2457c9250027c

services/project-delivery/k8s/rbac.yaml

@@ -0,0 +1,85 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: project-delivery-controller
+rules:
+  - apiGroups: [delivery.quorate.dev]
+    resources: [projectdeliveries]
+    verbs: [get, list, watch, update]
+  - apiGroups: [delivery.quorate.dev]
+    resources: [projectdeliveries/status]
+    verbs: [get, patch, update]
+  - apiGroups: [argoproj.io]
+    resources: [workflows]
+    verbs: [create, get, list, patch]
+  - apiGroups: [argoproj.io]
+    resources: [workflowtemplates]
+    verbs: [create, get, list, update]
+  - apiGroups: [""]
+    resources: [configmaps]
+    verbs: [create, get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: project-delivery-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: project-delivery-controller
+subjects:
+  - kind: ServiceAccount
+    name: project-delivery-controller
+    namespace: project-delivery
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: project-delivery-executor
+  namespace: project-delivery
+rules:
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - workflowtaskresults
+    verbs:
+      - create
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: project-delivery-executor
+  namespace: project-delivery
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: project-delivery-executor
+subjects:
+  - kind: ServiceAccount
+    name: project-delivery-executor
+    namespace: project-delivery
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: delivery-leader
+  namespace: project-delivery
+rules:
+  - apiGroups: [coordination.k8s.io]
+    resources: [leases]
+    verbs: [create, get, update]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: delivery-leader
+  namespace: project-delivery
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: delivery-leader
+subjects:
+  - kind: ServiceAccount
+    name: project-delivery-controller
+    namespace: project-delivery