mirror of
https://github.com/imjasonh/git-k8s
synced 2026-07-13 17:07:05 +00:00
cc391645e1
The *.k8s.io group is protected in Kubernetes and requires an api-approved.kubernetes.io annotation. Switch to a custom domain to avoid the restriction entirely. https://claude.ai/code/session_01QfFzqKQUsxxBsiZUhuJ3pG
101 lines
1.9 KiB
YAML
101 lines
1.9 KiB
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: git-k8s-controller
|
|
labels:
|
|
app.kubernetes.io/name: git-k8s
|
|
rules:
|
|
# Full access to all git-k8s.imjasonh.com custom resources.
|
|
- apiGroups:
|
|
- git-k8s.imjasonh.com
|
|
resources:
|
|
- gitrepositories
|
|
- gitbranches
|
|
- gitpushtransactions
|
|
- gitreposyncs
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- patch
|
|
- delete
|
|
# Status subresource access.
|
|
- apiGroups:
|
|
- git-k8s.imjasonh.com
|
|
resources:
|
|
- gitrepositories/status
|
|
- gitbranches/status
|
|
- gitpushtransactions/status
|
|
- gitreposyncs/status
|
|
verbs:
|
|
- get
|
|
- update
|
|
- patch
|
|
# Read secrets for Git authentication.
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
# Events for controller status reporting.
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
# ConfigMaps for leader election and config.
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- patch
|
|
- delete
|
|
# Leases for leader election.
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- patch
|
|
- delete
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: git-k8s-controller
|
|
labels:
|
|
app.kubernetes.io/name: git-k8s
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: git-k8s-controller
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: git-k8s-controller
|
|
namespace: git-system
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: git-k8s-controller
|
|
namespace: git-system
|
|
labels:
|
|
app.kubernetes.io/name: git-k8s
|