diff options
| author | Matt Bruzek <mbruzek@gmail.com> | 2018-01-18 15:27:13 -0600 |
|---|---|---|
| committer | Matt Bruzek <mbruzek@gmail.com> | 2018-01-18 15:27:13 -0600 |
| commit | cb581bfb67a53f887c4705d45fc7b0024a6816f9 (patch) | |
| tree | 9c351ddd9282f5d3d37c1189af0ac2ad444c0125 /files/origin-components/console-rbac-template.yaml | |
| parent | c7a1c448cbd64de98e1f097d14b58ee9f6ccf511 (diff) | |
| parent | 1a2a895356df638756d2117e3d324710167737db (diff) | |
| download | openshift-cb581bfb67a53f887c4705d45fc7b0024a6816f9.tar.gz openshift-cb581bfb67a53f887c4705d45fc7b0024a6816f9.tar.bz2 openshift-cb581bfb67a53f887c4705d45fc7b0024a6816f9.tar.xz openshift-cb581bfb67a53f887c4705d45fc7b0024a6816f9.zip | |
Merge branch 'master' into mbruzek-openshift-openstack
Diffstat (limited to 'files/origin-components/console-rbac-template.yaml')
| -rw-r--r-- | files/origin-components/console-rbac-template.yaml | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/files/origin-components/console-rbac-template.yaml b/files/origin-components/console-rbac-template.yaml new file mode 100644 index 000000000..9ee117199 --- /dev/null +++ b/files/origin-components/console-rbac-template.yaml @@ -0,0 +1,38 @@ +apiVersion: template.openshift.io/v1 +kind: Template +metadata: + name: web-console-server-rbac +parameters: +- name: NAMESPACE + # This namespace cannot be changed. Only `openshift-web-console` is supported. + value: openshift-web-console +objects: + + +# allow grant powers to the webconsole server for cluster inspection +- apiVersion: rbac.authorization.k8s.io/v1beta1 + kind: ClusterRole + metadata: + name: system:openshift:web-console-server + rules: + - apiGroups: + - "servicecatalog.k8s.io" + resources: + - clusterservicebrokers + verbs: + - get + - list + - watch + +# Grant the service account for the web console +- apiVersion: rbac.authorization.k8s.io/v1beta1 + kind: ClusterRoleBinding + metadata: + name: system:openshift:web-console-server + roleRef: + kind: ClusterRole + name: system:openshift:web-console-server + subjects: + - kind: ServiceAccount + namespace: ${NAMESPACE} + name: webconsole |