blob: 9ee1171996e984fb71ea9471edd2b01a894293e4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
apiVersion: template.openshift.io/v1
kind: Template
metadata:
name: web-console-server-rbac
parameters:
- name: NAMESPACE
# This namespace cannot be changed. Only `openshift-web-console` is supported.
value: openshift-web-console
objects:
# allow grant powers to the webconsole server for cluster inspection
- apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: system:openshift:web-console-server
rules:
- apiGroups:
- "servicecatalog.k8s.io"
resources:
- clusterservicebrokers
verbs:
- get
- list
- watch
# Grant the service account for the web console
- apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: system:openshift:web-console-server
roleRef:
kind: ClusterRole
name: system:openshift:web-console-server
subjects:
- kind: ServiceAccount
namespace: ${NAMESPACE}
name: webconsole
|
