Skip to content

Commit

Permalink
Enabling role, rolebinding and sa management for workspace admins (#4162
Browse files Browse the repository at this point in the history
)

Signed-off-by: David Peraza <[email protected]>
  • Loading branch information
dperaza4dustbit authored Jul 23, 2024
1 parent 4acde65 commit 5d0571c
Show file tree
Hide file tree
Showing 7 changed files with 651 additions and 2 deletions.
29 changes: 29 additions & 0 deletions components/sandbox/tiers/src/appstudio/spacerole_admin.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -241,6 +241,35 @@ objects:
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- roles
- rolebindings
verbs:
- get
- list
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- get
- list
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- serviceaccounts/token
verbs:
- create
# RoleBinding that grants limited CRUD permissions to the User
- apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- nstemplatetier-appstudio.yaml
- tiertemplate-appstudio-admin-1876853981-1876853981.yaml
- tiertemplate-appstudio-admin-2415879015-2415879015.yaml
- tiertemplate-appstudio-clusterresources-809836689-809836689.yaml
- tiertemplate-appstudio-contributor-1817914940-1817914940.yaml
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ spec:
- templateRef: appstudio-tenant-199961605-199961605
spaceRoles:
admin:
templateRef: appstudio-admin-2415879015-2415879015
templateRef: appstudio-admin-1876853981-1876853981
contributor:
templateRef: appstudio-contributor-1817914940-1817914940
maintainer:
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,309 @@
# ----------------------------------------------------------------
# Generated by cli - DO NOT EDIT
# ----------------------------------------------------------------

apiVersion: toolchain.dev.openshift.com/v1alpha1
kind: TierTemplate
metadata:
name: appstudio-admin-1876853981-1876853981
namespace: toolchain-host-operator
spec:
revision: 1876853981-1876853981
template:
apiVersion: template.openshift.io/v1
kind: Template
metadata: {}
objects:
- apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: appstudio-admin-user-actions
namespace: ${NAMESPACE}
rules:
- apiGroups:
- appstudio.redhat.com
resources:
- applications
- components
- imagerepositories
- componentdetectionqueries
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- deletecollection
- apiGroups:
- appstudio.redhat.com
resources:
- promotionruns
- snapshotenvironmentbindings
- snapshots
- environments
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- appstudio.redhat.com
resources:
- deploymenttargets
- deploymenttargetclaims
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- managed-gitops.redhat.com
resources:
- gitopsdeployments
- gitopsdeploymentmanagedenvironments
- gitopsdeploymentrepositorycredentials
- gitopsdeploymentsyncruns
verbs:
- get
- list
- watch
- apiGroups:
- tekton.dev
resources:
- pipelineruns
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- results.tekton.dev
resources:
- results
- records
- logs
verbs:
- get
- list
- apiGroups:
- appstudio.redhat.com
resources:
- enterprisecontractpolicies
- integrationtestscenarios
- releases
- releasestrategies
- releaseplans
- releaseplanadmissions
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- jvmbuildservice.io
resources:
- jbsconfigs
- artifactbuilds
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- appstudio.redhat.com
resources:
- spiaccesstokenbindings
- spiaccesschecks
- spiaccesstokens
- spifilecontentrequests
- spiaccesstokendataupdates
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- appstudio.redhat.com
resources:
- remotesecrets
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- appstudio.redhat.com
resources:
- buildpipelineselectors
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- ""
resourceNames:
- appstudio-pipeline
resources:
- serviceaccounts
verbs:
- get
- list
- watch
- update
- patch
- apiGroups:
- ""
resources:
- pods/exec
verbs:
- create
- apiGroups:
- toolchain.dev.openshift.com
resources:
- spacebindingrequests
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- projctl.konflux.dev
resources:
- projects
- projectdevelopmentstreams
- projectdevelopmentstreamtemplates
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- external-secrets.io
resources:
- secretstores
- externalsecrets
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- rbac.authorization.k8s.io
resources:
- roles
- rolebindings
verbs:
- get
- list
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- get
- list
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- serviceaccounts/token
verbs:
- create
- apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: appstudio-admin-${USERNAME}-actions-user
namespace: ${NAMESPACE}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: appstudio-admin-user-actions
subjects:
- kind: User
name: ${USERNAME}
- apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: appstudio-${USERNAME}-view-user
namespace: ${NAMESPACE}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: view
subjects:
- kind: User
name: ${USERNAME}
parameters:
- name: NAMESPACE
required: true
- name: USERNAME
required: true
tierName: appstudio
type: admin
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- nstemplatetier-appstudiolarge.yaml
- tiertemplate-appstudiolarge-admin-1884308846-1876853981.yaml
- tiertemplate-appstudiolarge-admin-1884308846-2415879015.yaml
- tiertemplate-appstudiolarge-clusterresources-1884308846-809836689.yaml
- tiertemplate-appstudiolarge-contributor-1884308846-1817914940.yaml
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ spec:
- templateRef: appstudiolarge-tenant-1884308846-199961605
spaceRoles:
admin:
templateRef: appstudiolarge-admin-1884308846-2415879015
templateRef: appstudiolarge-admin-1884308846-1876853981
contributor:
templateRef: appstudiolarge-contributor-1884308846-1817914940
maintainer:
Expand Down
Loading

0 comments on commit 5d0571c

Please sign in to comment.