diff --git a/helm/namespace/templates/role.yaml b/helm/namespace/templates/namespace-manager-role.yaml similarity index 54% rename from helm/namespace/templates/role.yaml rename to helm/namespace/templates/namespace-manager-role.yaml index 6b494dd..3a872a7 100755 --- a/helm/namespace/templates/role.yaml +++ b/helm/namespace/templates/namespace-manager-role.yaml @@ -55,50 +55,3 @@ rules: verbs: - list - get ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: namespace-readonly - namespace: {{ .Release.Name }} -rules: -- apiGroups: - - "" - - extensions - - apps - - batch - - autoscaling - - networking.k8s.io - - traefik.containo.us - - rbac.authorization.k8s.io - - metrics.k8s.io - - storage.k8s.io - resources: - - deployments - - replicasets - - pods - - pods/exec - - pods/log - - pods/attach - - daemonsets - - statefulsets - - replicationcontrollers - - horizontalpodautoscalers - - services - - ingresses - - persistentvolumeclaims - - jobs - - cronjobs - - secrets - - configmaps - - serviceaccounts - - rolebindings - - ingressroutes - - middlewares - - resourcequotas - - roles - - endpoints - - clusterroles - verbs: - - list - - watch diff --git a/helm/namespace/templates/rolebinding.yaml b/helm/namespace/templates/namespace-manager-rolebinding.yaml similarity index 52% rename from helm/namespace/templates/rolebinding.yaml rename to helm/namespace/templates/namespace-manager-rolebinding.yaml index 66cfd9f..d5b0c0d 100755 --- a/helm/namespace/templates/rolebinding.yaml +++ b/helm/namespace/templates/namespace-manager-rolebinding.yaml @@ -11,16 +11,3 @@ roleRef: kind: Role name: namespace-manager apiGroup: "" ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: user-readonly -subjects: -- kind: User - name: {{ .Values.user }} - apiGroup: "" -roleRef: - kind: ClusterRole - name: user-readonly - apiGroup: "" diff --git a/helm/namespace/templates/namespace-readonly-role.yaml b/helm/namespace/templates/namespace-readonly-role.yaml new file mode 100644 index 0000000..cf2a807 --- /dev/null +++ b/helm/namespace/templates/namespace-readonly-role.yaml @@ -0,0 +1,46 @@ +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: namespace-readonly + namespace: {{ .Release.Name }} +rules: +- apiGroups: + - "" + - extensions + - apps + - batch + - autoscaling + - networking.k8s.io + - traefik.containo.us + - rbac.authorization.k8s.io + - metrics.k8s.io + - storage.k8s.io + resources: + - deployments + - replicasets + - pods + - pods/exec + - pods/log + - pods/attach + - daemonsets + - statefulsets + - replicationcontrollers + - horizontalpodautoscalers + - services + - ingresses + - persistentvolumeclaims + - jobs + - cronjobs + - secrets + - configmaps + - serviceaccounts + - rolebindings + - ingressroutes + - middlewares + - resourcequotas + - roles + - endpoints + - clusterroles + verbs: + - list + - watch diff --git a/helm/namespace/templates/namespace-readonly-rolebinding.yaml b/helm/namespace/templates/namespace-readonly-rolebinding.yaml new file mode 100644 index 0000000..368d8c8 --- /dev/null +++ b/helm/namespace/templates/namespace-readonly-rolebinding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: user-readonly +subjects: +- kind: User + name: {{ .Values.user }} + apiGroup: "" +roleRef: + kind: ClusterRole + name: user-readonly + apiGroup: ""