From d1c4d61f0f2aeeb38a8bb6ef024968932ec6c2c3 Mon Sep 17 00:00:00 2001
From: Vaibhav Pathak <vaibhav.pathak@Vaibhavs-MacBook-Air.local>
Date: Mon, 23 Mar 2026 10:28:16 +0530
Subject: [PATCH] User creation added

---
 templates/backstage-rbac.yaml | 20 +++++++++++---------
 values.yaml                   |  2 +-
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/templates/backstage-rbac.yaml b/templates/backstage-rbac.yaml
index fc6afc2..227ff24 100644
--- a/templates/backstage-rbac.yaml
+++ b/templates/backstage-rbac.yaml
@@ -22,15 +22,17 @@ rules:
     resources: ["pods/log"]
     verbs: ["get", "list"]
 
-  # ServiceAccount token creation for kubeconfig generation
-  - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
-    verbs: ["create"]
-
-  # Read ServiceAccounts to verify existence
-  - apiGroups: [""]
-    resources: ["serviceaccounts"]
-    verbs: ["get", "list"]
+  # CSR creation and approval for kubeconfig generation
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests"]
+    verbs: ["create", "get", "list", "watch", "delete"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests/approval"]
+    verbs: ["update"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["kubernetes.io/kube-apiserver-client"]
+    verbs: ["approve"]
 
   # Read secrets for database credential discovery
   - apiGroups: [""]
diff --git a/values.yaml b/values.yaml
index 5422318..e1acca2 100644
--- a/values.yaml
+++ b/values.yaml
@@ -6,7 +6,7 @@ namespaceOverride: "backstage"
 # Backstage application image
 image:
   repository: gcr.io/prj-onlinesales-test-framework/backstage
-  tag: "main-8d37954"
+  tag: "main-bfb547c"
   pullPolicy: IfNotPresent
 
 # Replica count