29 lines
712 B
YAML
29 lines
712 B
YAML
 
|
# RBAC for api-gateway image promotion.
|
||
|
|
# Grants the api-gateway ServiceAccount get+patch on ArgoCD Applications
|
||
|
|
# so it can update kustomize.images / helm.parameters after a container push.
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRole
|
||
|
|
metadata:
|
||
|
|
name: image-promoter
|
||
|
|
labels:
|
||
|
|
app: api-gateway
|
||
|
|
rules:
|
||
|
|
- apiGroups: ["argoproj.io"]
|
||
|
|
resources: ["applications"]
|
||
|
|
verbs: ["get", "patch"]
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRoleBinding
|
||
|
|
metadata:
|
||
|
|
name: image-promoter-api-gateway
|
||
|
|
labels:
|
||
|
|
app: api-gateway
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: api-gateway
|
||
|
|
namespace: api
|
||
|
|
roleRef:
|
||
|
|
kind: ClusterRole
|
||
|
|
name: image-promoter
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|