Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 69b0ba3bcb | |||
| 587aef820f |
@@ -1,42 +0,0 @@
|
|||||||
---
|
|
||||||
# e2e-ci-runner-rbac.yaml
|
|
||||||
#
|
|
||||||
# Grants the GitHub Actions runner's service account (Arc Runners) the minimum
|
|
||||||
# permissions needed to deploy/teardown an E2E Headlamp instance in the
|
|
||||||
# privilegedescalation-dev namespace.
|
|
||||||
#
|
|
||||||
# RBAC is managed via Flux from privilegedescalation/infra — do not apply manually.
|
|
||||||
# This manifest is a reference copy in the plugin repo.
|
|
||||||
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: e2e-ci-runner
|
|
||||||
namespace: privilegedescalation-dev
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["configmaps", "serviceaccounts", "events"]
|
|
||||||
verbs: ["get", "list", "create", "delete"]
|
|
||||||
- apiGroups: ["apps"]
|
|
||||||
resources: ["deployments"]
|
|
||||||
verbs: ["get", "create", "delete"]
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["services"]
|
|
||||||
verbs: ["get", "create", "delete"]
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["pods"]
|
|
||||||
verbs: ["get", "list"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: e2e-ci-runner
|
|
||||||
namespace: privilegedescalation-dev
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: runners-privilegedescalation-gha-rs-no-permission
|
|
||||||
namespace: arc-runners
|
|
||||||
roleRef:
|
|
||||||
kind: Role
|
|
||||||
name: e2e-ci-runner
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
Reference in New Issue
Block a user