Skip to content

[templates] Add RBAC ClusterRoles for module CRDs (astef-prototype) #658

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
duckhawk wants to merge 1 commit into
base: astef-prototype
Choose a base branch
from
Open

[templates] Add RBAC ClusterRoles for module CRDs (astef-prototype) #658

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions templates/rbac-for-us.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: d8:sds-replicated-volume:admin-kubeconfig
{{- include "helm_lib_module_labels" (list .) | nindent 2 }}
rules:
- apiGroups:
- storage.deckhouse.io
resources:
- drbdmappers
- drbdnodeoperations
- drbdresourceoperations
- drbdresources
- replicatedstorageclasses
- replicatedstoragepools
- replicatedvolumeattachments
- replicatedvolumereplicas
- replicatedvolumes
verbs:
- get
- list
- watch
- create
- delete
- deletecollection
- patch
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: d8:sds-replicated-volume:admin-kubeconfig
{{- include "helm_lib_module_labels" (list .) | nindent 2 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: d8:sds-replicated-volume:admin-kubeconfig
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: kubeadm:cluster-admins
30 changes: 30 additions & 0 deletions templates/rbacv2/manage/edit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
heritage: deckhouse
module: sds-replicated-volume
rbac.deckhouse.io/aggregate-to-storage-as: manager
rbac.deckhouse.io/kind: manage
rbac.deckhouse.io/level: module
rbac.deckhouse.io/namespace: d8-sds-replicated-volume
name: d8:manage:permission:module:sds-replicated-volume:edit
rules:
- apiGroups:
- storage.deckhouse.io
resources:
- drbdmappers
- drbdnodeoperations
- drbdresourceoperations
- drbdresources
- replicatedstorageclasses
- replicatedstoragepools
- replicatedvolumeattachments
- replicatedvolumereplicas
- replicatedvolumes
verbs:
- create
- delete
- deletecollection
- patch
- update
28 changes: 28 additions & 0 deletions templates/rbacv2/manage/view.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
heritage: deckhouse
module: sds-replicated-volume
rbac.deckhouse.io/aggregate-to-storage-as: viewer
rbac.deckhouse.io/kind: manage
rbac.deckhouse.io/level: module
rbac.deckhouse.io/namespace: d8-sds-replicated-volume
name: d8:manage:permission:module:sds-replicated-volume:view
rules:
- apiGroups:
- storage.deckhouse.io
resources:
- drbdmappers
- drbdnodeoperations
- drbdresourceoperations
- drbdresources
- replicatedstorageclasses
- replicatedstoragepools
- replicatedvolumeattachments
- replicatedvolumereplicas
- replicatedvolumes
verbs:
- get
- list
- watch
52 changes: 52 additions & 0 deletions templates/user-authz-cluster-roles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
user-authz.deckhouse.io/access-level: User
name: d8:user-authz:sds-replicated-volume:user
{{- include "helm_lib_module_labels" (list .) | nindent 2 }}
rules:
- apiGroups:
- storage.deckhouse.io
resources:
- drbdmappers
- drbdnodeoperations
- drbdresourceoperations
- drbdresources
- replicatedstorageclasses
- replicatedstoragepools
- replicatedvolumeattachments
- replicatedvolumereplicas
- replicatedvolumes
verbs:
- get
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
user-authz.deckhouse.io/access-level: ClusterEditor
name: d8:user-authz:sds-replicated-volume:cluster-editor
{{- include "helm_lib_module_labels" (list .) | nindent 2 }}
rules:
- apiGroups:
- storage.deckhouse.io
resources:
- drbdmappers
- drbdnodeoperations
- drbdresourceoperations
- drbdresources
- replicatedstorageclasses
- replicatedstoragepools
- replicatedvolumeattachments
- replicatedvolumereplicas
- replicatedvolumes
verbs:
- create
- delete
- deletecollection
- patch
- update
Loading