fix: add RBAC for CI/Tekton trigger service account

ClusterRole: read pods/services/configmaps across cluster Tekton access: create/list/watch pipelineruns, taskruns Namespace RoleBindings: poimen, tekton-pipelines, llm-serving, kube-system Fixes: Forbidden errors when CI tries to list services
2026-09-15 08:07:38 +09:00
parent 364b87a11e
commit 3810babe10
1 changed files with 136 additions and 0 deletions
@@ -0,0 +1,136 @@
+---
+# ClusterRole for CI/Tekton triggers to deploy and manage resources across cluster
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ci-tekton-trigger
+rules:
+# Tekton resources
+- apiGroups: ["tekton.dev"]
+  resources: ["pipelineruns", "taskruns", "pipelines", "tasks"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+
+# Deployments and pods
+- apiGroups: ["apps"]
+  resources: ["deployments", "statefulsets", "daemonsets"]
+  verbs: ["get", "list", "watch", "create", "patch", "update"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log", "pods/status"]
+  verbs: ["get", "list", "watch"]
+
+# Services and networking
+- apiGroups: [""]
+  resources: ["services", "endpoints"]
+  verbs: ["get", "list", "watch"]
+
+# ConfigMaps and Secrets
+- apiGroups: [""]
+  resources: ["configmaps", "secrets"]
+  verbs: ["get", "list", "watch"]
+
+# Events
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
+
+# Namespaces
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get", "list", "watch"]
+
+# Persistent volumes
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims", "persistentvolumes"]
+  verbs: ["get", "list", "watch"]
+
+---
+# ClusterRoleBinding for ci-tekton-trigger service account
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: ci-tekton-trigger
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ci-tekton-trigger
+subjects:
+- kind: ServiceAccount
+  name: ci-tekton-trigger
+  namespace: api
+
+---
+# Additional ClusterRole for poimen namespace operations
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ci-tekton-trigger-poimen
+  namespace: poimen
+rules:
+# Allow full access in poimen namespace for CI
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["*"]
+
+---
+# RoleBinding in poimen namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ci-tekton-trigger-poimen
+  namespace: poimen
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ci-tekton-trigger-poimen
+subjects:
+- kind: ServiceAccount
+  name: ci-tekton-trigger
+  namespace: api
+
+---
+# RoleBinding in tekton-pipelines namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ci-tekton-trigger
+  namespace: tekton-pipelines
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ci-tekton-trigger
+subjects:
+- kind: ServiceAccount
+  name: ci-tekton-trigger
+  namespace: api
+
+---
+# RoleBinding in llm-serving namespace (for LLM checks)
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ci-tekton-trigger
+  namespace: llm-serving
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ci-tekton-trigger
+subjects:
+- kind: ServiceAccount
+  name: ci-tekton-trigger
+  namespace: api
+
+---
+# RoleBinding in kube-system namespace (for cluster info)
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ci-tekton-trigger
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ci-tekton-trigger
+subjects:
+- kind: ServiceAccount
+  name: ci-tekton-trigger
+  namespace: api