forked from suse-edge/Factory
93 lines
2.7 KiB
YAML
93 lines
2.7 KiB
YAML
|
{{- if .Values.rbac.enabled }}
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ServiceAccount
|
||
|
|
metadata:
|
||
|
|
name: akri-controller-sa
|
||
|
|
labels: {{- include "akri.labels" . | nindent 4 }}
|
||
|
|
app.kubernetes.io/name: akri-controller
|
||
|
|
app.kubernetes.io/component: controller
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ServiceAccount
|
||
|
|
metadata:
|
||
|
|
name: akri-agent-sa
|
||
|
|
labels: {{- include "akri.labels" . | nindent 4 }}
|
||
|
|
app.kubernetes.io/name: akri-agent
|
||
|
|
app.kubernetes.io/component: agent
|
||
|
|
---
|
||
|
|
kind: ClusterRole
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
metadata:
|
||
|
|
name: "akri-controller-role"
|
||
|
|
labels: {{- include "akri.labels" . | nindent 4 }}
|
||
|
|
app.kubernetes.io/name: akri-controller
|
||
|
|
app.kubernetes.io/component: controller
|
||
|
|
rules:
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["pods", "services"]
|
||
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||
|
|
- apiGroups: ["batch"]
|
||
|
|
resources: ["jobs"]
|
||
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"]
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["nodes"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
- apiGroups: [{{ .Values.crds.group | quote }}]
|
||
|
|
resources: ["instances"]
|
||
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
||
|
|
- apiGroups: [{{ .Values.crds.group | quote }}]
|
||
|
|
resources: ["configurations"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
---
|
||
|
|
kind: ClusterRole
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
metadata:
|
||
|
|
name: "akri-agent-role"
|
||
|
|
labels: {{- include "akri.labels" . | nindent 4 }}
|
||
|
|
app.kubernetes.io/name: akri-agent
|
||
|
|
app.kubernetes.io/component: agent
|
||
|
|
rules:
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["pods"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
- apiGroups: [{{ .Values.crds.group | quote }}]
|
||
|
|
resources: ["instances"]
|
||
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||
|
|
- apiGroups: [{{ .Values.crds.group | quote }}]
|
||
|
|
resources: ["configurations"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
---
|
||
|
|
apiVersion: 'rbac.authorization.k8s.io/v1'
|
||
|
|
kind: 'ClusterRoleBinding'
|
||
|
|
metadata:
|
||
|
|
name: 'akri-controller-binding'
|
||
|
|
namespace: {{ .Release.Namespace }}
|
||
|
|
labels: {{- include "akri.labels" . | nindent 4 }}
|
||
|
|
app.kubernetes.io/name: akri-controller
|
||
|
|
app.kubernetes.io/component: controller
|
||
|
|
roleRef:
|
||
|
|
apiGroup: ''
|
||
|
|
kind: 'ClusterRole'
|
||
|
|
name: 'akri-controller-role'
|
||
|
|
subjects:
|
||
|
|
- kind: 'ServiceAccount'
|
||
|
|
name: 'akri-controller-sa'
|
||
|
|
namespace: {{ .Release.Namespace }}
|
||
|
|
---
|
||
|
|
apiVersion: 'rbac.authorization.k8s.io/v1'
|
||
|
|
kind: 'ClusterRoleBinding'
|
||
|
|
metadata:
|
||
|
|
name: 'akri-agent-binding'
|
||
|
|
namespace: {{ .Release.Namespace }}
|
||
|
|
labels: {{- include "akri.labels" . | nindent 4 }}
|
||
|
|
app.kubernetes.io/name: akri-agent
|
||
|
|
app.kubernetes.io/component: agent
|
||
|
|
roleRef:
|
||
|
|
apiGroup: ''
|
||
|
|
kind: 'ClusterRole'
|
||
|
|
name: 'akri-agent-role'
|
||
|
|
subjects:
|
||
|
|
- kind: 'ServiceAccount'
|
||
|
|
name: 'akri-agent-sa'
|
||
|
|
namespace: {{ .Release.Namespace }}
|
||
|
|
{{- end }}
|