diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2018-01-16 07:30:07 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-01-16 07:30:07 -0800 |
| commit | 3a7f1992410edd296ec1fa15dddd67d82a545f9f (patch) | |
| tree | 4f27b80b38eb7cac9fe77c7ccdd85f8471c41f27 /files/origin-components/console-rbac-template.yaml | |
| parent | 0d59a0868971e7f038b775adef024a8f324ab010 (diff) | |
| parent | 486b746324171edd691fd1682ef1221825157e62 (diff) | |
| download | openshift-3a7f1992410edd296ec1fa15dddd67d82a545f9f.tar.gz openshift-3a7f1992410edd296ec1fa15dddd67d82a545f9f.tar.bz2 openshift-3a7f1992410edd296ec1fa15dddd67d82a545f9f.tar.xz openshift-3a7f1992410edd296ec1fa15dddd67d82a545f9f.zip | |
Merge pull request #6706 from spadgett/console-rbac
Automatic merge from submit-queue.
Add console RBAC template
Required for https://github.com/openshift/origin-web-console-server/pull/18
Origin changes: https://github.com/openshift/origin/pull/18075
/assign @sdodson
/cc @deads2k
Diffstat (limited to 'files/origin-components/console-rbac-template.yaml')
| -rw-r--r-- | files/origin-components/console-rbac-template.yaml | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/files/origin-components/console-rbac-template.yaml b/files/origin-components/console-rbac-template.yaml new file mode 100644 index 000000000..9ee117199 --- /dev/null +++ b/files/origin-components/console-rbac-template.yaml @@ -0,0 +1,38 @@ +apiVersion: template.openshift.io/v1 +kind: Template +metadata: + name: web-console-server-rbac +parameters: +- name: NAMESPACE + # This namespace cannot be changed. Only `openshift-web-console` is supported. + value: openshift-web-console +objects: + + +# allow grant powers to the webconsole server for cluster inspection +- apiVersion: rbac.authorization.k8s.io/v1beta1 + kind: ClusterRole + metadata: + name: system:openshift:web-console-server + rules: + - apiGroups: + - "servicecatalog.k8s.io" + resources: + - clusterservicebrokers + verbs: + - get + - list + - watch + +# Grant the service account for the web console +- apiVersion: rbac.authorization.k8s.io/v1beta1 + kind: ClusterRoleBinding + metadata: + name: system:openshift:web-console-server + roleRef: + kind: ClusterRole + name: system:openshift:web-console-server + subjects: + - kind: ServiceAccount + namespace: ${NAMESPACE} + name: webconsole |