55 lines
1.4 KiB
YAML
55 lines
1.4 KiB
YAML
|
# services/hermes/hux-evidence-rbac.yaml
|
||
|
|
# Read-only facts for the HUX-12 evidence producer sidecar: Ready pod
|
||
|
|
# imageIDs and the desired StatefulSet image in this namespace, plus the
|
||
|
|
# single named Flux Kustomization's applied revision. The pod service
|
||
|
|
# account gains nothing writable and nothing secret.
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: Role
|
||
|
|
metadata:
|
||
|
|
name: hermes-hux-evidence-read
|
||
|
|
namespace: hermes
|
||
|
|
rules:
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: [pods]
|
||
|
|
verbs: [get, list]
|
||
|
|
- apiGroups: [apps]
|
||
|
|
resources: [statefulsets]
|
||
|
|
verbs: [get]
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: RoleBinding
|
||
|
|
metadata:
|
||
|
|
name: hermes-hux-evidence-read
|
||
|
|
namespace: hermes
|
||
|
|
roleRef:
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|
||
|
|
kind: Role
|
||
|
|
name: hermes-hux-evidence-read
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: hermes-chat
|
||
|
|
namespace: hermes
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRole
|
||
|
|
metadata:
|
||
|
|
name: hermes-hux-evidence-kustomization-read
|
||
|
|
rules:
|
||
|
|
- apiGroups: [kustomize.toolkit.fluxcd.io]
|
||
|
|
resources: [kustomizations]
|
||
|
|
resourceNames: [hermes]
|
||
|
|
verbs: [get]
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRoleBinding
|
||
|
|
metadata:
|
||
|
|
name: hermes-hux-evidence-kustomization-read
|
||
|
|
roleRef:
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|
||
|
|
kind: ClusterRole
|
||
|
|
name: hermes-hux-evidence-kustomization-read
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: hermes-chat
|
||
|
|
namespace: hermes
|