2martens/cloud-configuration
1
0
Fork 0
mirror of https://github.com/2martens/cloud-configuration.git synced 2026-10-18 00:56:51 +02:00
Code Issues Activity

Added cluster role for sensible admin without access to secrets

Browse Source
This commit is contained in:
2martens
2023-11-10 09:40:52 +01:00
parent ff3ead170f
commit 6ecbb978d5
1 changed files with 360 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/cluster_setup/templates/admin-without-secrets-cluster-role.yaml
+360
View File
@@ -0,0 +1,360 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: admin-without-secrets
rules:
- verbs:
- get
- watch
- list
apiGroups:
- ''
resources:
- nodes
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- cert-manager.io
resources:
- certificates
- certificaterequests
- issuers
- verbs:
- update
apiGroups:
- cert-manager.io
resources:
- certificates/status
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- acme.cert-manager.io
resources:
- challenges
- orders
- verbs:
- get
- list
- watch
apiGroups:
- cert-manager.io
resources:
- certificates
- certificaterequests
- issuers
- verbs:
- get
- list
- watch
apiGroups:
- acme.cert-manager.io
resources:
- challenges
- orders
- verbs:
- list
apiGroups:
- 'metrics.k8s.io'
resources:
- nodes
- pods
- verbs:
- get
- list
- watch
apiGroups:
- ''
resources:
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
- services/proxy
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- ''
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
- verbs:
- create
apiGroups:
- ''
resources:
- pods/eviction
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- ''
resources:
- configmaps
- events
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- serviceaccounts
- services
- services/proxy
- namespaces
- verbs:
- create
apiGroups:
- ''
resources:
- serviceaccounts/token
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- apps
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- statefulsets/scale
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- batch
resources:
- cronjobs
- jobs
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- extensions
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- ingresses
- networkpolicies
- replicasets
- replicasets/scale
- replicationcontrollers/scale
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- policy
resources:
- poddisruptionbudgets
- verbs:
- create
- delete
- deletecollection
- patch
- update
apiGroups:
- networking.k8s.io
resources:
- ingresses
- networkpolicies
- verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
apiGroups:
- coordination.k8s.io
resources:
- leases
- verbs:
- get
- list
- watch
apiGroups:
- ''
resources:
- configmaps
- endpoints
- persistentvolumeclaims
- persistentvolumeclaims/status
- pods
- replicationcontrollers
- replicationcontrollers/scale
- serviceaccounts
- services
- services/status
- verbs:
- get
- list
- watch
apiGroups:
- ''
resources:
- bindings
- events
- limitranges
- namespaces/status
- pods/log
- pods/status
- replicationcontrollers/status
- resourcequotas
- resourcequotas/status
- verbs:
- get
- list
- watch
apiGroups:
- ''
resources:
- namespaces
- verbs:
- get
- list
- watch
apiGroups:
- discovery.k8s.io
resources:
- endpointslices
- verbs:
- get
- list
- watch
apiGroups:
- apps
resources:
- controllerrevisions
- daemonsets
- daemonsets/status
- deployments
- deployments/scale
- deployments/status
- replicasets
- replicasets/scale
- replicasets/status
- statefulsets
- statefulsets/scale
- statefulsets/status
- verbs:
- get
- list
- watch
apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
- horizontalpodautoscalers/status
- verbs:
- get
- list
- watch
apiGroups:
- batch
resources:
- cronjobs
- cronjobs/status
- jobs
- jobs/status
- verbs:
- get
- list
- watch
apiGroups:
- extensions
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/scale
- deployments/status
- ingresses
- ingresses/status
- networkpolicies
- replicasets
- replicasets/scale
- replicasets/status
- replicationcontrollers/scale
- verbs:
- get
- list
- watch
apiGroups:
- policy
resources:
- poddisruptionbudgets
- poddisruptionbudgets/status
- verbs:
- get
- list
- watch
apiGroups:
- networking.k8s.io
resources:
- ingresses
- ingresses/status
- networkpolicies
- verbs:
- create
apiGroups:
- authorization.k8s.io
resources:
- localsubjectaccessreviews
- verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
- roles