add new role and role binding for adviser

add role which will be used for adviser workflows so that secrets created for callback urls can be deleted
thoth-station · Jul 11, 2022 · 2801047 · 2801047
1 parent eb5adee
commit 2801047
Show file tree

Hide file tree

Showing 8 changed files with 67 additions and 0 deletions.
diff --git a/adviser/base/adviser-sa.yaml b/adviser/base/adviser-sa.yaml
@@ -0,0 +1,29 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: adviser
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: delete-secrets
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - delete  # for wfh send webhooks step
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: adviser
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: delete-secrets
+subjects:
+  - kind: ServiceAccount
+    name: adviser
diff --git a/adviser/base/kustomization.yaml b/adviser/base/kustomization.yaml
@@ -15,5 +15,6 @@ resources:
   - openshift-templates/adviser.yaml
   - openshift-templates/dependency-monkey.yaml
   - openshift-templates/provenance-checker.yaml
+  - adviser-sa.yaml
   - imagestream.yaml
   - configmap.yaml
diff --git a/adviser/overlays/aws-prod/adviser-rolebinding-patch.yaml b/adviser/overlays/aws-prod/adviser-rolebinding-patch.yaml
@@ -0,0 +1,6 @@
+- op: add
+  path: /metadata/namespace
+  value: thoth-backend-prod
+- op: add
+  path: /subjects/0/namespace
+  value: thoth-backend-prod
diff --git a/adviser/overlays/aws-prod/kustomization.yaml b/adviser/overlays/aws-prod/kustomization.yaml
@@ -98,3 +98,10 @@ patches:
       version: v1alpha1
       kind: WorkflowTemplate
       name: dm
+  # workflow helpers patch rolebinding
+  - path: adviser-rolebinding-patch.yaml
+    target:
+      group: apps
+      version: v1
+      kind: RoleBinding
+      name: adviser
diff --git a/adviser/overlays/moc-prod/adviser-rolebinding-patch.yaml b/adviser/overlays/moc-prod/adviser-rolebinding-patch.yaml
@@ -0,0 +1,6 @@
+  - op: add
+    path: /metadata/namespace
+    value: thoth-backend-prod
+  - op: add
+    path: /subjects/0/namespace
+    value: thoth-backend-prod
diff --git a/adviser/overlays/moc-prod/kustomization.yaml b/adviser/overlays/moc-prod/kustomization.yaml
@@ -98,3 +98,9 @@ patches:
       version: v1alpha1
       kind: WorkflowTemplate
       name: dm
+  - path: adviser-rolebinding-patch.yaml
+    target:
+      group: apps
+      version: v1
+      kind: RoleBinding
+      name: adviser
diff --git a/adviser/overlays/ocp4-stage/adviser-rolebinding-patch.yaml b/adviser/overlays/ocp4-stage/adviser-rolebinding-patch.yaml
@@ -0,0 +1,6 @@
+- op: add
+  path: /metadata/namespace
+  value: thoth-backend-stage
+- op: add
+  path: /subjects/0/namespace
+  value: thoth-backend-stage
diff --git a/adviser/overlays/ocp4-stage/kustomization.yaml b/adviser/overlays/ocp4-stage/kustomization.yaml
@@ -91,3 +91,9 @@ patches:
       version: v1alpha1
       kind: WorkflowTemplate
       name: dm
+  - path: adviser-rolebinding-patch.yaml
+    target:
+      group: apps
+      version: v1
+      kind: RoleBinding
+      name: adviser