add rbac rules to make oc work in a backup job

image/Dockerfile

@@ -13,7 +13,8 @@ RUN yum --enablerepo=extras install -y epel-release && \
 COPY tools /opt/intly/tools
 RUN chown -R 1001:root /opt/intly
 
-RUN find /opt/intly/tools -type f -exec chmod +x {} \;
+RUN find /opt/intly/tools -type f -exec chmod +x {} \; && \
+    mkdir /.kube && touch /.kube/config && chmod -R 777 /.kube
 
 ENTRYPOINT ["/opt/intly/tools/entrypoint.sh"]
 

templates/openshift/backup-cronjob-template.yaml

@@ -20,6 +20,7 @@ objects:
               labels:
                 cronjob-name: ${NAME}
             spec:
+              serviceAccountName: backupjob
               containers:
                 - name: backup-cronjob
                   image: "${IMAGE}"
@@ -71,4 +72,4 @@ parameters:
     description: 'Backup docker image URL'
     value: 'quay.io/integreatly/backup-container:master'
   - name: DEBUG
-    description: "Debug flag to sleep the job pod after its execution"
+    description: "Debug flag to sleep the job pod after its execution"

templates/openshift/backup-job-template.yaml

@@ -19,6 +19,7 @@ objects:
           labels:
             job-name: ${NAME}
         spec:
+          serviceAccountName: backupjob
           containers:
             - name: backup-job
               image: "${IMAGE}"
@@ -67,4 +68,4 @@ parameters:
     description: 'Backup docker image URL'
     value: 'quay.io/integreatly/backup-container:master'
   - name: DEBUG
-    description: "Debug flag to sleep the job pod after its execution"
+    description: "Debug flag to sleep the job pod after its execution"

templates/openshift/rbac/role-binding.yaml

@@ -0,0 +1,9 @@
+apiVersion: authorization.openshift.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backupjob
+roleRef:
+  name: backupjob
+subjects:
+  - kind: ServiceAccount
+    name: backupjob

templates/openshift/rbac/role.yaml

@@ -0,0 +1,12 @@
+apiVersion: authorization.openshift.io/v1
+kind: ClusterRole
+metadata:
+  name: backupjob
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - secrets
+    verbs:
+      - '*'

templates/openshift/rbac/service-account.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backupjob