---
apiVersion: v1
kind: Namespace
metadata:
  name: argo
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: argo-vso
  namespace: argo
---
apiVersion: v1
kind: Namespace
metadata:
  name: argo-relay-admission
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: relay-admission-vso
  namespace: argo-relay-admission
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: relay-admission-publisher
  namespace: argo-relay-admission
imagePullSecrets:
  - name: quay-cluster-pull
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: relay-admission-executor
  namespace: argo-relay-admission
rules:
  - apiGroups: [argoproj.io]
    resources: [workflowtaskresults]
    verbs: [create, get, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: relay-admission-executor
  namespace: argo-relay-admission
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: relay-admission-executor
subjects:
  - kind: ServiceAccount
    name: relay-admission-publisher
    namespace: argo-relay-admission
---
apiVersion: v1
kind: Namespace
metadata:
  name: argo-relay-smtp-deny
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: relay-smtp-deny-vso
  namespace: argo-relay-smtp-deny
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: relay-smtp-deny-publisher
  namespace: argo-relay-smtp-deny
imagePullSecrets:
  - name: quay-cluster-pull
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: relay-smtp-deny-executor
  namespace: argo-relay-smtp-deny
rules:
  - apiGroups: [argoproj.io]
    resources: [workflowtaskresults]
    verbs: [create, get, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: relay-smtp-deny-executor
  namespace: argo-relay-smtp-deny
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: relay-smtp-deny-executor
subjects:
  - kind: ServiceAccount
    name: relay-smtp-deny-publisher
    namespace: argo-relay-smtp-deny
---
apiVersion: v1
kind: Namespace
metadata:
  name: argo-opnsense-certificate
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: opnsense-certificate-vso
  namespace: argo-opnsense-certificate
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: opnsense-certificate-rotator
  namespace: argo-opnsense-certificate
imagePullSecrets:
  - name: quay-cluster-pull
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: opnsense-certificate-executor
  namespace: argo-opnsense-certificate
rules:
  - apiGroups: [argoproj.io]
    resources: [workflowtaskresults]
    verbs: [create, get, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: opnsense-certificate-executor
  namespace: argo-opnsense-certificate
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: opnsense-certificate-executor
subjects:
  - kind: ServiceAccount
    name: opnsense-certificate-rotator
    namespace: argo-opnsense-certificate