7

kubernetes/apps/disabled/drone/runner/rbac.yaml

@@ -0,0 +1,70 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: drone
+  namespace: drone-ci
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - watch
+      - update
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: drone
+  namespace: drone-ci
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: drone-ci
+roleRef:
+  kind: Role
+  name: drone
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: drone-deploy-sa
+  namespace: public-services
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: public-services
+  name: drone-deployment-manager
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "create", "update", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: drone-deployment-manager-binding
+  namespace: public-services
+subjects:
+  - kind: ServiceAccount
+    name: drone-deploy-sa
+    namespace: public-services
+roleRef:
+  kind: Role
+  name: drone-deployment-manager
+  apiGroup: rbac.authorization.k8s.io