mirror of
https://github.com/vee1e/krply.git
synced 2026-09-01 09:49:51 +00:00
41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
# Replay ClusterRole: create/patch access for the replay identity.
|
|
#
|
|
# Used by `krply replay apply` against a disposable TARGET cluster only. It can
|
|
# only create and update the declarative roots krply replays (namespaces,
|
|
# configmaps, services, deployments, statefulsets, daemonsets); it cannot
|
|
# delete and has no access to Secrets, Pods, or other kinds. get/list are
|
|
# granted for the dry-run phase and to verify the plan target.
|
|
#
|
|
# This role is intentionally NOT cluster-admin. Never grant the replay identity
|
|
# write access to a production/source cluster.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: krply-replay
|
|
labels:
|
|
app.kubernetes.io/name: krply
|
|
app.kubernetes.io/component: replay
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces", "configmaps", "services"]
|
|
verbs: ["create", "patch", "update", "get", "list"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments", "statefulsets", "daemonsets"]
|
|
verbs: ["create", "patch", "update", "get", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: krply-replay
|
|
labels:
|
|
app.kubernetes.io/name: krply
|
|
app.kubernetes.io/component: replay
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: krply-replay
|
|
subjects:
|
|
# Replace with the ServiceAccount that runs replay in the target cluster.
|
|
- kind: ServiceAccount
|
|
name: krply-replay
|
|
namespace: krply
|