| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111 |
- {{- if .Values.deploy.restapi }}
- {{- $allowedNamespaces := regexSplit " " (include "allowedNamespaces" .) -1 }}
- {{- range $index, $namespace := $allowedNamespaces }}
- {{- if and (eq $index 0) (not $.Values.disableClusterRole) }}
- ---
- apiVersion: rbac.authorization.k8s.io/v1
- kind: ClusterRole
- metadata:
- labels:
- api.stackgres.io/auth: user
- name: stackgres-restapi-reader
- {{- with $.Values.clusterOwnerRefereces }}
- ownerReferences:
- {{- toYaml . | nindent 4 }}
- {{- end }}
- rules:
- - apiGroups: ["apiextensions.k8s.io"]
- resources:
- - customresourcedefinitions
- resourceNames:
- - sgconfigs.stackgres.io
- - sgclusters.stackgres.io
- - sginstanceprofiles.stackgres.io
- - sgpgconfigs.stackgres.io
- - sgpoolconfigs.stackgres.io
- - sgbackups.stackgres.io
- - sgbackupconfigs.stackgres.io
- - sgobjectstorages.stackgres.io
- - sgdbops.stackgres.io
- - sgdistributedlogs.stackgres.io
- - sgshardedclusters.stackgres.io
- - sgscripts.stackgres.io
- - sgstreams.stackgres.io
- verbs:
- - get
- - apiGroups: ["apiextensions.k8s.io"]
- resources:
- - customresourcedefinitions
- verbs:
- - list
- - apiGroups: ["", "storage.k8s.io"]
- resources:
- - namespaces
- - storageclasses
- verbs:
- - get
- - list
- - watch
- {{- end }}
- {{- if not (eq $namespace "_all_namespaces_placeholder") }}
- ---
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
- namespace: {{ $namespace }}
- name: stackgres-restapi-reader
- rules:
- {{- end }}
- - apiGroups: ["", "batch"]
- resources:
- - pods/exec
- verbs:
- - create
- - apiGroups: [""]
- resources:
- - pods/exec
- verbs:
- - get
- - apiGroups: ["", "batch", "storage.k8s.io"]
- resources:
- - pods
- - services
- - configmaps
- - secrets
- - persistentvolumes
- - persistentvolumeclaims
- - events
- - jobs
- verbs:
- - get
- - list
- - watch
- - apiGroups: ["stackgres.io"]
- resources:
- - sgclusters
- - sgpgconfigs
- - sginstanceprofiles
- - sgpoolconfigs
- - sgbackupconfigs
- - sgbackups
- - sgdistributedlogs
- - sgdbops
- - sgobjectstorages
- - sgscripts
- - sgshardedclusters
- - sgshardedbackups
- - sgshardeddbops
- - sgstreams
- verbs:
- - watch
- - list
- - get
- - apiGroups: ["stackgres.io"]
- resources:
- - sgconfigs
- verbs:
- - watch
- - list
- - get
- {{- end }}
- {{- end }}
|
