78 lines
2.4 KiB
YAML
78 lines
2.4 KiB
YAML
---
|
|
# ClusterRole for workflow execution - allows creating namespaces and deploying resources
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: workflow-executor
|
|
rules:
|
|
# Namespace management
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["create", "get", "list", "patch", "update", "delete"]
|
|
|
|
# Apps - Deployments, DaemonSets, StatefulSets, ReplicaSets
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments", "daemonsets", "statefulsets", "replicasets"]
|
|
verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
|
|
|
|
# Core resources - Services, ConfigMaps, Secrets, ReplicationControllers
|
|
- apiGroups: [""]
|
|
resources: ["services", "configmaps", "secrets", "replicationcontrollers"]
|
|
verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
|
|
|
|
# Batch - Jobs and CronJobs
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs", "cronjobs"]
|
|
verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
|
|
|
|
# Autoscaling - HorizontalPodAutoscalers
|
|
- apiGroups: ["autoscaling"]
|
|
resources: ["horizontalpodautoscalers"]
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Resource Quotas and Limit Ranges
|
|
- apiGroups: [""]
|
|
resources: ["resourcequotas", "limitranges"]
|
|
verbs: ["create", "get", "list", "patch", "update", "delete"]
|
|
|
|
# Network Policies
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["networkpolicies"]
|
|
verbs: ["create", "get", "list", "patch", "update", "delete"]
|
|
|
|
# Pods for verification and workflow execution
|
|
- apiGroups: [""]
|
|
resources: ["pods", "pods/log"]
|
|
verbs: ["get", "list", "watch", "patch", "update"]
|
|
|
|
# ArgoCD Applications (CRDs)
|
|
- apiGroups: ["argoproj.io"]
|
|
resources: ["applications"]
|
|
verbs: ["create", "get", "list", "patch", "update", "delete"]
|
|
|
|
# Argo Workflows - for labeling workflows
|
|
- apiGroups: ["argoproj.io"]
|
|
resources: ["workflows"]
|
|
verbs: ["get", "list", "patch", "update"]
|
|
|
|
---
|
|
# Bind the workflow-executor role to the default service account in argo namespace
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: workflow-executor-binding
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: workflow-executor
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: default
|
|
namespace: argo
|
|
- kind: ServiceAccount
|
|
name: argo
|
|
namespace: argo
|
|
- kind: ServiceAccount
|
|
name: argo-server
|
|
namespace: argo
|