Scope rule engine rollout permissions

2026-10-20 11:35:18 +02:00
parent b4349b49c4
commit b9f832858a
3 changed files with 90 additions and 1 deletions
@@ -0,0 +1,66 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ai-spel-rule-engine-deployer
+  namespace: argocd
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ai-spel-rule-engine-deployer-token
+  namespace: argocd
+  annotations:
+    kubernetes.io/service-account.name: ai-spel-rule-engine-deployer
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ai-spel-rule-engine-deployer
+  namespace: argocd
+rules:
+  - apiGroups: [argoproj.io]
+    resources: [applications]
+    resourceNames: [ai-spel-rule-engine]
+    verbs: [get, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ai-spel-rule-engine-deployer
+  namespace: argocd
+subjects:
+  - kind: ServiceAccount
+    name: ai-spel-rule-engine-deployer
+    namespace: argocd
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ai-spel-rule-engine-deployer
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ai-spel-rule-engine-deployer
+  namespace: ai-spel
+rules:
+  - apiGroups: [apps]
+    resources: [deployments, replicasets, statefulsets]
+    verbs: [get, list, watch]
+  - apiGroups: [""]
+    resources: [pods, events]
+    verbs: [get, list, watch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ai-spel-rule-engine-deployer
+  namespace: ai-spel
+subjects:
+  - kind: ServiceAccount
+    name: ai-spel-rule-engine-deployer
+    namespace: argocd
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ai-spel-rule-engine-deployer