health: allow portal wger sync

services/bstein-dev-home/rbac.yaml

@@ -106,34 +106,3 @@ subjects:
   - kind: ServiceAccount
     name: bstein-dev-home
     namespace: bstein-dev-home
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: bstein-dev-home-wger-user-sync
-  namespace: health
-rules:
-  - apiGroups: ["batch"]
-    resources: ["cronjobs"]
-    verbs: ["get"]
-    resourceNames: ["wger-user-sync"]
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["create", "get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: bstein-dev-home-wger-user-sync
-  namespace: health
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: bstein-dev-home-wger-user-sync
-subjects:
-  - kind: ServiceAccount
-    name: bstein-dev-home
-    namespace: bstein-dev-home

services/health/kustomization.yaml

@@ -5,6 +5,7 @@ namespace: health
 resources:
   - namespace.yaml
   - serviceaccount.yaml
+  - portal-rbac.yaml
   - wger-media-pvc.yaml
   - wger-static-pvc.yaml
   - wger-admin-ensure-cronjob.yaml

services/health/portal-rbac.yaml

@@ -0,0 +1,31 @@
+# services/health/portal-rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: bstein-dev-home-wger-user-sync
+  namespace: health
+rules:
+  - apiGroups: ["batch"]
+    resources: ["cronjobs"]
+    verbs: ["get"]
+    resourceNames: ["wger-user-sync"]
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: bstein-dev-home-wger-user-sync
+  namespace: health
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: bstein-dev-home-wger-user-sync
+subjects:
+  - kind: ServiceAccount
+    name: bstein-dev-home
+    namespace: bstein-dev-home