Add RBAC roles associated with HMC management

Signed-off-by: Andrei Pavlov <[email protected]>
zerospiel · Sep 17, 2024 · e271ed6 · e271ed6
1 parent 67162e9
commit e271ed6
Show file tree

Hide file tree

Showing 4 changed files with 56 additions and 0 deletions.
diff --git a/templates/provider/hmc/templates/rbac/user-facing/management-editor.yaml b/templates/provider/hmc/templates/rbac/user-facing/management-editor.yaml
@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hmc.fullname" . }}-management-editor-role
+rules:
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
+      - management
+    verbs: {{ include "rbac.editorVerbs" . | nindent 6 }}
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
+      - providertemplates
+    verbs: {{ include "rbac.viewerVerbs" . | nindent 6 }}
+      - create
diff --git a/templates/provider/hmc/templates/rbac/user-facing/management-viewer.yaml b/templates/provider/hmc/templates/rbac/user-facing/management-viewer.yaml
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hmc.fullname" . }}-management-viewer-role
+rules:
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
+      - management
+      - providertemplates
+    verbs: {{ include "rbac.viewerVerbs" . | nindent 6 }}
diff --git a/templates/provider/hmc/templates/rbac/user-facing/templatemanagement-editor.yaml b/templates/provider/hmc/templates/rbac/user-facing/templatemanagement-editor.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hmc.fullname" . }}-templatemanagement-editor-role
+rules:
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
+      - templatemanagements
+    verbs: {{ include "rbac.editorVerbs" . | nindent 6 }}
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
+      - servicetemplatechains
+      - clustertemplatechains
+    verbs: {{ include "rbac.viewerVerbs" . | nindent 6 }}
+      - create
diff --git a/templates/provider/hmc/templates/rbac/user-facing/templatemanagement-viewer.yaml b/templates/provider/hmc/templates/rbac/user-facing/templatemanagement-viewer.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "hmc.fullname" . }}-templatemanagement-viewer-role
+rules:
+  - apiGroups:
+      - hmc.mirantis.com
+    resources:
+      - templatemanagements
+      - clustertemplatechains
+      - servicetemplatechains
+    verbs: {{ include "rbac.viewerVerbs" . | nindent 6 }}