move RBAC manifests from components/authentication/base to componen… (

#2322) * move RBAC manifests from `components/authentication/base` to component specific directory 1. pipeline-service 2. multi-arch-controller * FRHTAP-1201: RH - Fix secret store version (#2341) The enging that contains the S3 secrets is of type v1. Signed-off-by: gbenhaim <[email protected]> * move RBAC manifests from `components/authentication/base` to component specific directory 1. pipeline-service 2. multi-arch-controller --------- Signed-off-by: gbenhaim <[email protected]> Co-authored-by: Gal Ben Haim <[email protected]>
redhat-appstudio · Aug 31, 2023 · 63817ed · 63817ed
1 parent 41dc409
commit 63817ed
Show file tree

Hide file tree

Showing 24 changed files with 368 additions and 247 deletions.
diff --git a/components/authentication/base/build.yaml b/components/authentication/base/build.yaml
diff --git a/components/authentication/base/component-maintainer.yaml b/components/authentication/base/component-maintainer.yaml
@@ -42,6 +42,7 @@ rules:
     resources:
       - results
       - records
+      - logs
     verbs:
       - get
       - list

diff --git a/components/authentication/base/kustomization.yaml b/components/authentication/base/kustomization.yaml
@@ -1,9 +1,7 @@
 resources:
 - everyone-can-view.yaml
 - component-maintainer.yaml
-- build.yaml
 - group-sync/
-- pipeline-service-sre.yaml
 - inspect-pods.yaml
 
 apiVersion: kustomize.config.k8s.io/v1beta1

diff --git a/components/authentication/base/pipeline-service-sre.yaml b/components/authentication/base/pipeline-service-sre.yaml
diff --git a/components/multi-arch-controller/base/rbac/kustomization.yaml b/components/multi-arch-controller/base/rbac/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- role-binding.yaml
diff --git a/components/multi-arch-controller/base/rbac/role-binding.yaml b/components/multi-arch-controller/base/rbac/role-binding.yaml
@@ -0,0 +1,78 @@
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: multi-arch-controller-maintainer
+rules:
+  - apiGroups:
+      - operators.coreos.com
+    resources:
+      - installplans
+    verbs:
+      - get
+      - list
+      - update
+      - patch
+  - verbs:
+      - patch
+      - get
+    apiGroups:
+      - ''
+    resources:
+      - serviceaccounts
+    resourceNames:
+      - pipeline # TODO: figure out how to 'gitops' this.
+  - verbs:
+      - create
+      - get
+      - list
+      - watch
+      - delete
+    apiGroups:
+      - ''
+    resources:
+      - secrets
+  - verbs:
+      - '*' # needed till we figure out how to cleanup workspaces.
+    apiGroups:
+      - 'tekton.dev'
+    resources:
+      - 'pipelineruns'
+  - apiGroups:
+      - results.tekton.dev
+    resources:
+      - results
+      - records
+    verbs:
+      - get
+      - list
+  - apiGroups:
+    - ''
+    resources:
+    - pods/portforward
+    verbs:
+    - create
+  - apiGroups:
+      - 'apps'
+    resources:
+      - deployments
+    verbs:
+      - get
+      - patch
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: multi-arch-controller-maintainers
+  namespace: multi-arch-controller
+subjects:
+  - kind: User
+    apiGroup: rbac.authorization.k8s.io
+    name: sbose78
+  - kind: User
+    apiGroup: rbac.authorization.k8s.io
+    name: stuartwdouglas
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: multi-arch-controller-maintainer
diff --git a/components/multi-arch-controller/development/kustomization.yaml b/components/multi-arch-controller/development/kustomization.yaml
@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ../base
+- ../base/rbac
 
 patches:
   - target:

diff --git a/components/multi-arch-controller/staging/kustomization.yaml b/components/multi-arch-controller/staging/kustomization.yaml
@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ../base
+- ../base/rbac
 - ../base/external-secrets
diff --git a/components/pipeline-service/base/rbac/cluster-role/kustomization.yaml b/components/pipeline-service/base/rbac/cluster-role/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pipeline-service-sre.yaml
+  - pipeline-maintainer.yaml
-Original file line number
+Diff line change
@@ Expand Up / @@ -42,6 +42,7 @@ rules: @@
         resources:
           - results
           - records
+          - logs
         verbs:
           - get
           - list
@@ Expand Down @@