summaryrefslogtreecommitdiffstats
path: root/files/origin-components/rbac-template.yaml
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2018-01-26 17:38:26 -0800
committerGitHub <noreply@github.com>2018-01-26 17:38:26 -0800
commit65d69eca7dc6ac71c25a6a5c9a3936e2bb49a5d8 (patch)
tree03ce2701a4550fb4a996fc4edfae94c363fdc271 /files/origin-components/rbac-template.yaml
parentef8e18254cd96b7b68a5e01ee0b2ae6b3a10d3c6 (diff)
parent7dceb6260a333e29c922dad8613ae6a0946fa07b (diff)
downloadopenshift-65d69eca7dc6ac71c25a6a5c9a3936e2bb49a5d8.tar.gz
openshift-65d69eca7dc6ac71c25a6a5c9a3936e2bb49a5d8.tar.bz2
openshift-65d69eca7dc6ac71c25a6a5c9a3936e2bb49a5d8.tar.xz
openshift-65d69eca7dc6ac71c25a6a5c9a3936e2bb49a5d8.zip
Merge pull request #6840 from yocum137/rm_origin-components
Automatic merge from submit-queue. moving files to their correct <role>/files location The openshift_web_console and template_service_broker roles are putting 'files' outside the openshift-ansible roles they belong to.
Diffstat (limited to 'files/origin-components/rbac-template.yaml')
-rw-r--r--files/origin-components/rbac-template.yaml92
1 files changed, 0 insertions, 92 deletions
diff --git a/files/origin-components/rbac-template.yaml b/files/origin-components/rbac-template.yaml
deleted file mode 100644
index 0937a9065..000000000
--- a/files/origin-components/rbac-template.yaml
+++ /dev/null
@@ -1,92 +0,0 @@
-apiVersion: template.openshift.io/v1
-kind: Template
-metadata:
- name: template-service-broker-rbac
-parameters:
-- name: NAMESPACE
- value: openshift-template-service-broker
-- name: KUBE_SYSTEM
- value: kube-system
-objects:
-
-# Grant the service account permission to call the TSB
-- apiVersion: rbac.authorization.k8s.io/v1beta1
- kind: ClusterRoleBinding
- metadata:
- name: templateservicebroker-client
- roleRef:
- kind: ClusterRole
- name: system:openshift:templateservicebroker-client
- subjects:
- - kind: ServiceAccount
- namespace: ${NAMESPACE}
- name: templateservicebroker-client
-
-# to delegate authentication and authorization
-- apiVersion: rbac.authorization.k8s.io/v1beta1
- kind: ClusterRoleBinding
- metadata:
- name: auth-delegator-${NAMESPACE}
- roleRef:
- kind: ClusterRole
- name: system:auth-delegator
- subjects:
- - kind: ServiceAccount
- namespace: ${NAMESPACE}
- name: apiserver
-
-# to have the template service broker powers
-- apiVersion: rbac.authorization.k8s.io/v1beta1
- kind: ClusterRoleBinding
- metadata:
- name: tsb-${NAMESPACE}
- roleRef:
- kind: ClusterRole
- name: system:openshift:controller:template-service-broker
- subjects:
- - kind: ServiceAccount
- namespace: ${NAMESPACE}
- name: apiserver
-
-# to read the config for terminating authentication
-- apiVersion: rbac.authorization.k8s.io/v1beta1
- kind: RoleBinding
- metadata:
- namespace: ${KUBE_SYSTEM}
- name: extension-apiserver-authentication-reader-${NAMESPACE}
- roleRef:
- kind: Role
- name: extension-apiserver-authentication-reader
- subjects:
- - kind: ServiceAccount
- namespace: ${NAMESPACE}
- name: apiserver
-
-# allow the kube service catalog's SA to read the static secret defined
-# above, which will contain the token for the SA that can call the TSB.
-- apiVersion: rbac.authorization.k8s.io/v1beta1
- kind: Role
- metadata:
- name: templateservicebroker-auth-reader
- namespace: ${NAMESPACE}
- rules:
- - apiGroups:
- - ""
- resourceNames:
- - templateservicebroker-client
- resources:
- - secrets
- verbs:
- - get
-- apiVersion: rbac.authorization.k8s.io/v1beta1
- kind: RoleBinding
- metadata:
- namespace: ${NAMESPACE}
- name: templateservicebroker-auth-reader
- roleRef:
- kind: Role
- name: templateservicebroker-auth-reader
- subjects:
- - kind: ServiceAccount
- namespace: kube-service-catalog
- name: service-catalog-controller