Add RBAC permission for appcatalog

Signed-off-by: Tamal Saha <tamal@appscode.com>
kubedb · Oct 3, 2018 · 30705d7 · 30705d7
1 parent 6c8c232
commit 30705d7
Show file tree

Hide file tree

Showing 5 changed files with 71 additions and 0 deletions.
diff --git a/chart/kubedb/templates/appcatalog-user-roles.yaml b/chart/kubedb/templates/appcatalog-user-roles.yaml
@@ -0,0 +1,34 @@
+{{ if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: appscode:appcatalog:admin
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
+rules:
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["*"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: appscode:appcatalog:view
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation
+rules:
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["get", "list", "watch"]
+{{ end }}
diff --git a/chart/kubedb/templates/cluster-role.yaml b/chart/kubedb/templates/cluster-role.yaml
@@ -84,6 +84,11 @@ rules:
   resources:
   - "*"
   verbs: ["*"]
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["*"]
 - apiGroups:
   - monitoring.coreos.com
   resources:

diff --git a/hack/deploy/appcatalog-user-roles.yaml b/hack/deploy/appcatalog-user-roles.yaml
@@ -0,0 +1,26 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: appscode:appcatalog:admin
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+rules:
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["*"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: appscode:appcatalog:view
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["get", "list", "watch"]
diff --git a/hack/deploy/kubedb.sh b/hack/deploy/kubedb.sh
@@ -366,6 +366,7 @@ if [ "$KUBEDB_ENABLE_RBAC" = true ]; then
   ${SCRIPT_LOCATION}hack/deploy/service-account.yaml | $ONESSL envsubst | kubectl apply -f -
   ${SCRIPT_LOCATION}hack/deploy/rbac-list.yaml | $ONESSL envsubst | kubectl auth reconcile -f -
   ${SCRIPT_LOCATION}hack/deploy/user-roles.yaml | $ONESSL envsubst | kubectl auth reconcile -f -
+  ${SCRIPT_LOCATION}hack/deploy/appcatalog-user-roles.yaml | $ONESSL envsubst | kubectl auth reconcile -f -
 fi
 
 if [ "$KUBEDB_RUN_ON_MASTER" -eq 1 ]; then

diff --git a/hack/deploy/rbac-list.yaml b/hack/deploy/rbac-list.yaml
@@ -80,6 +80,11 @@ rules:
   resources:
   - "*"
   verbs: ["*"]
+- apiGroups:
+  - appcatalog.appscode.com
+  resources:
+  - "*"
+  verbs: ["*"]
 - apiGroups:
   - monitoring.coreos.com
   resources: