summaryrefslogtreecommitdiffstats
path: root/files/origin-components/console-rbac-template.yaml
blob: 9ee1171996e984fb71ea9471edd2b01a894293e4 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: web-console-server-rbac
parameters:
- name: NAMESPACE
  # This namespace cannot be changed. Only `openshift-web-console` is supported.
  value: openshift-web-console
objects:


# allow grant powers to the webconsole server for cluster inspection
- apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRole
  metadata:
    name: system:openshift:web-console-server
  rules:
  - apiGroups:
    - "servicecatalog.k8s.io"
    resources:
    - clusterservicebrokers
    verbs:
    - get
    - list
    - watch

# Grant the service account for the web console
- apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRoleBinding
  metadata:
    name: system:openshift:web-console-server
  roleRef:
    kind: ClusterRole
    name: system:openshift:web-console-server
  subjects:
  - kind: ServiceAccount
    namespace: ${NAMESPACE}
    name: webconsole