User creation added

templates/backstage-rbac.yaml

@@ -22,15 +22,17 @@ rules:
     resources: ["pods/log"]
     verbs: ["get", "list"]
 
-  # ServiceAccount token creation for kubeconfig generation
-  - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
-    verbs: ["create"]
-
-  # Read ServiceAccounts to verify existence
-  - apiGroups: [""]
-    resources: ["serviceaccounts"]
-    verbs: ["get", "list"]
+  # CSR creation and approval for kubeconfig generation
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests"]
+    verbs: ["create", "get", "list", "watch", "delete"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests/approval"]
+    verbs: ["update"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["kubernetes.io/kube-apiserver-client"]
+    verbs: ["approve"]
 
   # Read secrets for database credential discovery
   - apiGroups: [""]

values.yaml

@@ -6,7 +6,7 @@ namespaceOverride: "backstage"
 # Backstage application image
 image:
   repository: gcr.io/prj-onlinesales-test-framework/backstage
-  tag: "main-8d37954"
+  tag: "main-bfb547c"
   pullPolicy: IfNotPresent
 
 # Replica count