diff options
| author | Samuel Padgett <spadgett@redhat.com> | 2018-01-11 15:24:37 -0500 |
|---|---|---|
| committer | Samuel Padgett <spadgett@redhat.com> | 2018-01-11 15:24:37 -0500 |
| commit | 486b746324171edd691fd1682ef1221825157e62 (patch) | |
| tree | 5f7ac31e5f14e0b6de9914320a3000efea8122d5 /files | |
| parent | fdc5829d6ca252e1574278cd1dc50e932378d98d (diff) | |
| download | openshift-486b746324171edd691fd1682ef1221825157e62.tar.gz openshift-486b746324171edd691fd1682ef1221825157e62.tar.bz2 openshift-486b746324171edd691fd1682ef1221825157e62.tar.xz openshift-486b746324171edd691fd1682ef1221825157e62.zip | |
Add console RBAC template
Diffstat (limited to 'files')
| -rw-r--r-- | files/origin-components/console-rbac-template.yaml | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/files/origin-components/console-rbac-template.yaml b/files/origin-components/console-rbac-template.yaml new file mode 100644 index 000000000..9ee117199 --- /dev/null +++ b/files/origin-components/console-rbac-template.yaml @@ -0,0 +1,38 @@ +apiVersion: template.openshift.io/v1 +kind: Template +metadata: + name: web-console-server-rbac +parameters: +- name: NAMESPACE + # This namespace cannot be changed. Only `openshift-web-console` is supported. + value: openshift-web-console +objects: + + +# allow grant powers to the webconsole server for cluster inspection +- apiVersion: rbac.authorization.k8s.io/v1beta1 + kind: ClusterRole + metadata: + name: system:openshift:web-console-server + rules: + - apiGroups: + - "servicecatalog.k8s.io" + resources: + - clusterservicebrokers + verbs: + - get + - list + - watch + +# Grant the service account for the web console +- apiVersion: rbac.authorization.k8s.io/v1beta1 + kind: ClusterRoleBinding + metadata: + name: system:openshift:web-console-server + roleRef: + kind: ClusterRole + name: system:openshift:web-console-server + subjects: + - kind: ServiceAccount + namespace: ${NAMESPACE} + name: webconsole |