Olares/build/base-package/wizard/config/settings/templates/system-serviceaccount.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: os-platform
  name: os-internal

---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: os-framework
  name: os-internal

---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: os-network
  name: os-network-internal

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: os-platform:os-internal-rb
subjects:
  - kind: ServiceAccount
    namespace: os-platform
    name: os-internal
roleRef:
  # kind: Role
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: os-framework:os-internal-rb
subjects:
  - kind: ServiceAccount
    namespace: os-framework
    name: os-internal
roleRef:
  # kind: Role
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: os-network:os-network-rb
subjects:
  - kind: ServiceAccount
    namespace: os-network
    name: os-network-internal
roleRef:
  # kind: Role
  kind: ClusterRole
  name: l4-proxy-role
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tapr-images-role
rules:
- apiGroups:
  - '*'
  resources:
  - users
  - configmaps
  - secrets
  verbs:
  - get

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sys-editor-role
rules:
- apiGroups:
  - sys.bytetrade.io
  - app.bytetrade.io
  resources:
  - '*'
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - '*'
  resources:
  - 'clusterroles'
  - 'clusterrolebindings'
  - 'services'
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - '*'
  resources:
  - pods
  - users
  - configmaps
  - secrets
  - nodes
  - namespaces
  verbs:
  - get
  - list
  - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: rbac-proxy
rules:
- apiGroups: ["authentication.k8s.io"]
  resources:
  - tokenreviews
  verbs: ["create"]
- apiGroups: ["authorization.k8s.io"]
  resources:
  - subjectaccessreviews
  verbs: ["create"]

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: percona-server-mongodb-operator
rules:
- apiGroups:
  - psmdb.percona.com
  resources:
  - perconaservermongodbs
  - perconaservermongodbs/status
  - perconaservermongodbbackups
  - perconaservermongodbbackups/status
  - perconaservermongodbrestores
  - perconaservermongodbrestores/status
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - pods
  - pods/exec
  - services
  - persistentvolumeclaims
  - secrets
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - apps
  resources:
  - deployments
  - replicasets
  - statefulsets
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - batch
  resources:
  - cronjobs
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - certmanager.k8s.io
  - cert-manager.io
  resources:
  - issuers
  - certificates
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
  - deletecollection
- apiGroups:
  - net.gke.io
  - multicluster.x-k8s.io
  resources:
  - serviceexports
  - serviceimports
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
  - deletecollection


---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: l4-proxy-role
rules:
- apiGroups:
  - '*'
  resources:
  - users
  - applications
  verbs:
  - get
  - list
  - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: nonresourceurl-admin
rules:
- nonResourceURLs: ["*"]
  verbs: ["*"]