first commit

CODEOWNERS

@@ -0,0 +1,3 @@
+/ @frankfarzan
+/online @filmil
+/online/shipping-app-backend @mdruskin @briantkennedy

README.md

@@ -0,0 +1 @@
+# foo-corp-example

namespace-viewer-role.yaml

@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: namespace-readers
+subjects:
+- kind: User
+  name: [email protected]
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: namespace-reader
+  apiGroup: rbac.authorization.k8s.io

namespace-viewer-rolebinding.yaml

@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: namespace-readers
+subjects:
+- kind: User
+  name: [email protected]
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: namespace-reader
+  apiGroup: rbac.authorization.k8s.io

online/pod-reader-role.yaml

@@ -0,0 +1,8 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: pod-reader
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list"]

online/shipping-app-backend/pod-creator-rolebinding.yaml

@@ -0,0 +1,12 @@
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: team-pod-creator
+subjects:
+- kind: Group
+  name: shiiping-app-backend-team
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: pod-creator
+  apiGroup: rbac.authorization.k8s.io

online/shipping-app-backend/pod-reader-rolebinding.yaml

@@ -0,0 +1,12 @@
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: alice-rolebinding
+subjects:
+- kind: User
+  name: [email protected]
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: pod-reader
+  apiGroup: rbac.authorization.k8s.io

online/shipping-app-backend/quota.yaml

@@ -0,0 +1,7 @@
+kind: ResourceQuota
+apiVersion: v1
+metadata:
+  name: pod-quota
+spec:
+  hard:
+    pods: "3"

online/shipping-app-backend/shipping-dev/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: shipping-dev

online/shipping-app-backend/shipping-dev/quota.yaml

@@ -0,0 +1,7 @@
+kind: ResourceQuota
+apiVersion: v1
+metadata:
+  name: pod-quota
+spec:
+  hard:
+    pods: "1"

online/shipping-app-backend/shipping-prod/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: shipping-prod

online/shipping-app-backend/shipping-staging/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: shipping-staging

pod-creator-role.yaml

@@ -0,0 +1,9 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: pod-creator
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs:
+  - "*"

pod-creator.yaml

@@ -0,0 +1,9 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: pod-creator
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs:
+  - "*"

pod-security-policy.yaml

@@ -0,0 +1,16 @@
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: psp
+spec:
+  privileged: false
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  fsGroup:
+    rule: RunAsAny
+  volumes:
+  - '*'